Crypto CEO accuses North Korea of stealing $387 million from Bitget platform
Singaporean crypto platform Bitget said hackers stole more than $387 million from its exchange after suffering a breach on Thursday.
The company’s CEO, Gracy Chen, held a town hall after the incident and said evidence linked the theft to hackers from North Korea — which has stolen billions from other cryptocurrency platforms over the last five years.
Blockchain security firms initially saw more than $175 million leave the platform on Thursday before larger chunks were stolen from Bitget. Chen said the company’s security team initially detected unauthorized transfers and immediately activated emergency protocols.
She confirmed that the initial estimate of the losses amounts to $387.5 million. She noted that the company has a User Protection Fund that has over $464 million and those funds will be used to cover the losses.
Withdrawals from the platform are currently suspended while the company works with security firms Mandiant and SlowMist on the recovery effort. Law enforcement and other crypto platforms were notified about the incident.
Chen later explained that an investigation found hackers had breached a backend system of Bitget’s wallet services and exploited vulnerabilities to enable unauthorized transfers.
“Bitget has navigated multiple market cycles. We will not run from this. Every dollar and every decision will be accounted for, transparently and in full,” Chen said.
The hackers stole ETH, XRP, USDC and several other coins. Chen noted that several platforms have already frozen some funds connected to the hackers’ wallets. She added that there is now a recovery bounty program where platforms will get 5% for voluntarily freezing attacker funds and 5% if funds are recovered.
In later comments, she said IP addresses, behavioral patterns and on-chain signatures indicated that the attack is tied to North Korean-linked hacker groups.
“We have notified relevant authorities and are cooperating fully with them globally,” Chen said during the town hall.
Other blockchain experts began to track the funds and found links to past crypto thefts conducted by North Korea’s Lazarus Group – a notorious hacking operation accused of perpetrating several high profile heists.
The country’s government stole more than $2 billion in similar attacks last year and brought in $3 billion from attacks on cryptocurrency platforms between 2017 and 2023, according to United Nations investigators.
Earlier this year, North Korean hackers allegedly conducted two attacks that saw them steal $280 million from the crypto platform Kelp and another $290 million from the Drift crypto platform in a sophisticated operation involving fake companies, alleged actors and more.
During her town hall, Chen mentioned North Korea’s theft of $1.5 billion from Dubai-based platform Bybit last year, noting that the company was able to survive the incident.
“If Bybit can hold on [after] a $1.5 billion loss, we can definitely hold on to a $350 million+ loss,” she said. “Just like Bybit can hold on after their bank run and liquidity issue, we can too.”
References in this story
- Bitget (@bitget) on X x.com Live about Bitget Hot Wallet Incident on September 24, 2026 https://t.co/limZaY2pRf
- Specter (@SpecterAnalyst) on X x.com Regarding who is behind the hack: I present to you THE LAZARUS GROUP. just linked this hack to the AFX hack, which stole $24M in July and was specifically attributed to TraderTraitor. The stolen XRP from Bitget was…
- Over $3.4 billion in crypto stolen throughout 2025, with North Korea again the top culprit therecord.media Of the $3.4 billion in crypto stolen from January to December, Chainalysis attributed at least $2.02 billion to North Korean hackers.
- UN probing 58 alleged crypto heists by North Korea worth $3 billion therecord.media U.N. experts reported on the activity of North Korean cyberthreat actors, including those known to researchers as Kimsuky, the Lazarus Group, Andariel and BlueNoroff.
- Crypto infrastructure company blames $290 million theft on North Korean hackers therecord.media A theft of nearly $300 million worth of cryptocurrency has been attributed to hackers from North Korea, as the industry grapples with the fallout of a wide-ranging incident involving multiple prominent platforms.
- Drift crypto platform confirms $280 million stolen in hack as researchers point finger at North Korea therecord.media The platform released a post-mortem on Wednesday night explaining that malicious actors gained access to Drift systems through a “novel attack” that involved the “rapid takeover” of the company’s security council…
- ‘It reads like a spy novel’: $280 million theft from Drift involved North Korean fake companies, cutouts therecord.media Drift officials said the operation began six months ago, when they were approached at a cryptocurrency conference by members of a company claiming to focus on quantitative trading.
- Hackers drained $1.4 billion of cryptocurrency from Bybit exchange, CEO confirms therecord.media The cryptocurrency exchange Bybit was hacked for more than $1.4 billion worth of Ethereum on Friday in what cybersecurity experts are calling the largest-ever theft targeting a cryptocurrency platform.
- Advanced Cyber Threat Intelligence | Recorded Future www.recordedfuture.com Get real-time, actionable cyber threat intelligence with Recorded Future. Mitigate cyber risks, prioritize threats, and proactively secure your organization.
- Advanced Cyber Threat Intelligence | Recorded Future www.recordedfuture.com Get real-time, actionable cyber threat intelligence with Recorded Future. Mitigate cyber risks, prioritize threats, and proactively secure your organization.
- jon greig (@jgreigj) on X twitter.com @TheRecord_Media cybersecurity reporter. formerly @zdnet @cambodiadaily @haitiantimes_ — send tips to [email protected] or signal: jgreig.51
- jon greig (@jgreig.bsky.social) bsky.app cybersecurity reporter for The Record. formerly: zdnet, techrepublic, blavity, haitian times, cambodia daily — send tips to [email protected] or signal: jgreig.51
