Bitget Loses $352 Million in Hack, CEO Suspects North Korea
Set Trending Topics as a preferred source on Google.
The crypto exchange that helped rescue Bybit with 40,000 Ether after its record hack is now reporting a multimillion theft of its own, and according to its CEO, the trail leads to North Korea.
Bitget detected unauthorized transfers from parts of its hot and warm wallets on Thursday. The company puts the damage at around $351.6 million, roughly 300 million euros. Its cold wallets were not affected, and further outflows have been stopped, Bitget said. Withdrawals are suspended for now while trading continues, Cointelegraph reports.
IP Addresses Point to a North Korean Group
In a livestream on X, CEO Gracy Chen said the exchange had identified IP addresses whose VPN usage matches that of a specific North Korean hacking group. The pattern closely resembles earlier attacks attributed to North Korea, she said. Bitget rules out an inside job. Chen also stressed that the attribution has not yet been fully confirmed.
According to preliminary findings from Bitget’s security team, the attackers broke into a critical backend system of the exchange’s wallet infrastructure, forged transfer details there and then triggered the exchange’s regular, authorized signing process. No private keys were leaked in the process. How exactly the attackers gained access is still under investigation, as investingLive summarizes. Chen added that some of the funds have already been recovered, without giving a figure.
On-chain tracker Lookonchain has broken down the haul. The largest share is around 102.9 million XRP worth about 135 million euros, followed by 31,890 Ether (around 74 million euros). The rest consists of stablecoins such as USDT and USDC, along with smaller amounts of Tether Gold, BNB, AVAX and TRX.
Protection Fund Meant to Cover the Loss
For customers, the key question is whether Bitget has enough reserves. The exchange points to its Protection Fund, which currently holds more than $465 million (around 400 million euros) and could cover the loss on its own. On top of that, Bitget says it has more than $1 billion (around 860 million euros) in its own capital.
Chen rejected comparisons with FTX, the exchange that collapsed in 2022. She drew a comparison with Bybit instead: both exchanges run retail businesses of similar size, she argued, and if Bybit could survive a $1.5 billion loss, Bitget can absorb one of around $350 million. A full incident report has been announced. The real test will come once withdrawals reopen and it becomes clear how many users pull their funds.
Looking Back: The Largest Crypto Hack in History
In February 2025, hackers stole Ether worth around $1.5 billion from Bybit, roughly 1.4 billion euros at the time. It remains the largest known theft in crypto history. The FBI attributed the attack to North Korea, specifically to the TraderTraitor cluster linked to the notorious Lazarus Group.
The attackers took an indirect route. They compromised a developer’s computer at Safe{Wallet}, the multisig service Bybit relied on, and injected malicious code into its user interface. Bybit’s signers were shown what looked like a routine transaction while control of the cold wallet was being redirected in the background, as a technical analysis by NCC Group shows.
The result was a full-blown bank run. As Trending Topics reported at the time, users withdrew around 670 million euros in the first hour after the hack became public, and total withdrawals climbed to more than 3.8 billion euros.
How Bybit Secured Its Survival
Bybit weathered the blow thanks to fast communication and massive support from across the industry. CEO Ben Zhou publicly promised that all withdrawal requests would be honored and arranged bridge loans from partners. According to Zhou, these covered around 80 percent of the stolen amount within a short time, FXStreet reported. In total, Bybit received around 446,870 Ether (about 1.2 billion euros at the time) through loans, deposits from large investors and purchases, according to Lookonchain.
Bitget was among those who stepped in. The exchange lent Bybit 40,000 Ether worth around 100 million euros, with no interest and no collateral. Bybit repaid the loan within three days, as Cointelegraph documented. At the same time, Bybit launched a bounty program offering 10 percent of any recovered funds as a reward.
In the months that followed, Bybit expanded its security architecture and obtained a MiCAR license in Austria, as Trending Topics reported.
North Korea as a Persistent Threat to Crypto Exchanges
The Bitget case is the latest in a long series. North Korean hackers are linked to crypto thefts worth around $2.02 billion in 2025 alone, roughly 1.8 billion euros. The stolen funds are considered an important source of foreign currency for the regime.
