Bitget CEO Says $352M Hack May Involve North Korea, Citing IP Clues

Bitget CEO Gracy Chen said preliminary investigations indicate North Korean hackers may be behind the exchange’s $351.6 million security breach disclosed on Thursday. In a live Q&A on X after the incident, Chen pointed to investigator-identified IP addresses that align with VPN services previously used by a Democratic People’s Republic of Korea (DPRK) hacking group, adding that the attackers’ behavior resembled tactics from earlier campaigns.

Chen also said Bitget does not believe the breach involved an inside job. She further described the mechanics of the theft: investigators concluded that hackers moved funds directly rather than attempting to forge user withdrawal requests, and that the attackers did not obtain Bitget’s cold-wallet or hot-and-warm-wallet private keys.

Key takeaways

• Attribution signals: Bitget’s CEO cited preliminary links between specific IP addresses and VPN choices associated with a DPRK group.
• No inside-job assumption: Chen said the exchange does not currently believe there was an internal compromise.
• How funds were taken: Bitget described direct fund transfers, not forged withdrawal requests.
• Key security controls: Chen said investigators did not find evidence that private keys for cold or hot/warm wallets were accessed.
• Recovery efforts underway: Some stolen funds were reported recovered, though Bitget did not disclose an amount.

Why Bitget’s preliminary attribution points to DPRK activity

Chen’s most concrete evidence, at least at the stage described publicly, centers on network infrastructure. During the X Q&A, she said investigators identified some IP addresses that match the VPN selections used by a DPRK-linked group. She characterized the overall attack pattern as consistent with methods used in prior North Korean operations.

The CEO’s comments matter beyond headline attribution because they can shape how traders, institutions, and partners assess risk and incident timelines. If the VPN and behavioral indicators continue to hold up under forensic review, it strengthens the case that the breach is part of the broader pattern of state-linked cybercrime targeting digital asset infrastructure.

Bitget’s framing also echoes broader reporting on North Korea’s role in crypto theft. Cointelegraph previously noted that North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including an approximately $1.5 billion Bybit hack that the FBI attributed to North Korea.

What Bitget says happened during the breach

Beyond attribution, Chen provided operational details about the alleged theft process. She said hackers accessed Bitget’s systems and transferred funds directly, explicitly adding that they did not forge user withdrawal requests.

Chen further stated that investigators have not found evidence that the attackers obtained private keys associated with Bitget’s cold wallet or its hot and warm wallets. She said the investigation is still focused on determining which internal systems were compromised and how the attackers gained access in the first place.

For users and counterparties, these distinctions are important. A breach involving private-key extraction typically suggests a different threat level and broader recovery challenges than an incident where attackers manipulate systems to move funds. Chen’s account—direct transfers without key compromise—implies Bitget’s security design may have contained the damage, even as attackers were still able to reach and move assets.

Withdrawals suspended; exchange reports partial recovery

Chen’s remarks come after Bitget reported unauthorized transfers impacting parts of its hot and warm wallet infrastructure. At the time of publication, withdrawals remained suspended, reflecting Bitget’s caution while it continues incident response and reconciliation.

During the Q&A, Chen said some of the stolen funds had been recovered, but she did not specify the amount. She also said the exchange is working with blockchain foundations and other partners on recovery efforts.

For market participants, exchange recovery timelines can materially affect liquidity and user confidence, especially when withdrawals are paused. Even partial recovery—without a stated figure—signals that defenders may have regained control of certain assets or succeeded in interrupting some of the flow after the compromise.

Earlier coverage from Cointelegraph noted the breadth of user-facing impact. In a report on Bitget’s response, Cointelegraph stated that the exchange confirmed the $352M security breach and suspended withdrawals amid reports of affected funds. (See: Bitget calls security withdrawal claims unverified amid $178m breach reports.)

What to watch next as the investigation develops

Chen’s public explanation provides a framework—VPN-linked IP indicators, a lack of evidence of private-key compromise, and a non-insider working assumption—but important questions remain open. Bitget is still determining the scope of compromised systems and the access method, and those findings are likely to influence how credible the DPRK attribution ultimately appears.

Going forward, readers should monitor whether Bitget expands on the technical chain of intrusion (for example, whether the breach began via compromised credentials, a system-level weakness, or some other vector) and whether partners or third-party incident analysts corroborate the VPN/IP and behavioral claims. As recovery continues and more forensic details emerge, the key issue will be whether the initial story holds—or whether additional evidence changes the attribution and the lessons other exchanges draw from the incident.