Bitget CEO Gracy Chen said the crypto exchange’s latest hack, which led to roughly $352 million in losses, likely shows signs of a North Korean operation.
Large withdrawals were spotted a day earlier from addresses labeled as Bitget hot and cold wallets, drawing immediate scrutiny from the crypto community. Crypto investigator Specter Analyst linked the incident to the Lazarus Group, the hacking collective widely associated with North Korea. Chen later said in a livestream that the attack carried indicators consistent with a North Korean operation.
Chen outlined the breach in a livestream
In a post on X, Chen said she had hosted a livestream about seven hours earlier that ran for more than three hours. Summarizing the session, she said the stream included a security incident update about an hour in and that the company was sharing specific facts rather than broad reassurances. She also said affected assets included ETH.
Chen added that multiple chains had frozen addresses connected to the hack. She also said Bitget Wallet, which operates separately from the exchange, was not affected.
Bitget says private keys were not compromised
Chen ruled out a private key compromise. According to her explanation, the attackers breached the wallet services backend system, forged transfer details, and authorized their own signing processes.
She said Bitget’s cold wallets remained secure, while the exchange’s hot wallets and warm wallet layers were the parts that were targeted.
User funds said to be covered by protection fund
Chen said user funds were safe and that most of the loss would be covered by Bitget’s User Protection Fund, which she said "currently holds over $464 million."
Bitget is now working with independent investigators Mandiant and SlowMist to determine exactly what happened. The exchange said this morning that withdrawals remain temporarily paused.
The report said the scale of the hack was initially expected to be much smaller. It also noted that the incident happened as Bitget was marking its eighth birthday.
