Bitget Confirms $351.6 Million Security Breach, Suspects North Korean Hackers

The exchange halted withdrawals after a hot wallet compromise, with its CEO pointing to IP address clues.

Bitget's chief executive publicly confirmed a security breach affecting $351.6 million in digital assets. The funds were held in the exchange's hot wallet infrastructure, according to the company's disclosure. Hot wallets are connected to the internet for faster transaction processing, which makes them more exposed than offline cold storage.

The exchange responded by suspending customer withdrawals shortly after detecting the breach. Suspending withdrawals is a standard containment step exchanges take to stop further outflows while they assess the scope of a compromise. It also gives security teams time to trace the movement of stolen funds across blockchains.

Bitget's CEO said the company suspects North Korean state-linked hackers were behind the intrusion. The suspicion is based on IP address clues uncovered during the investigation, according to the CEO's statement. North Korean hacking groups, most notably the Lazarus Group, have been repeatedly linked by investigators and government agencies to major cryptocurrency thefts over the past several years.

Those groups have historically targeted exchange hot wallets, bridge contracts, and custodial infrastructure to extract large sums quickly before assets can be frozen or traced. Stolen funds are often laundered through mixers, cross-chain bridges, and decentralized exchanges to obscure their origin. Attribution in these cases is frequently difficult to confirm with full certainty, even when technical indicators like IP addresses point in a particular direction.

The $351.6 million figure places this incident among the larger hot wallet breaches reported in the crypto industry this year. The exact breakdown of which assets were affected, and whether any funds have since been recovered or frozen, was not detailed in the available disclosures. Bitget has not specified a timeline for restoring withdrawal functionality.

Exchanges that suffer large breaches typically face pressure to demonstrate they can cover user losses from company reserves, insurance funds, or external backers. How an exchange handles the aftermath, including communication with affected users and any compensation plans, often shapes its long-term reputation more than the breach itself. Bitget's next public updates are likely to focus on the investigation's findings and any steps taken to secure remaining customer funds.

Market Impact

A breach of this size on a major exchange typically raises short-term concerns among users about counterparty and custody risk. Withdrawal suspensions can trigger anxiety even among unaffected users, since they limit access to funds regardless of whether an individual account was compromised. Traders and depositors often react by moving assets to other platforms or into self-custody until an exchange restores full functionality and clarifies the scope of losses.

The suspected North Korean link, if substantiated by further investigation, would add this incident to a broader pattern of state-linked theft targeting the crypto industry. That pattern has already drawn attention from regulators and law enforcement agencies internationally. Continued high-profile breaches tend to intensify calls for stronger custody standards, proof-of-reserves practices, and closer scrutiny of exchange hot wallet management across the industry.

Bitget's investigation into the breach and its attempts to trace the stolen funds are ongoing. Further details on recovery efforts, withdrawal restoration, and any formal attribution are expected as the exchange continues its review.

Frequently Asked Questions

What did Bitget confirm about the security breach?

Bitget's CEO confirmed a breach affecting $351.6 million held in the exchange's hot wallets, prompting an internal investigation and a suspension of withdrawals.

Why does Bitget suspect North Korea was involved?

The CEO cited IP address clues uncovered during the investigation as the basis for suspecting North Korean state-linked hackers, though the exchange has not confirmed final attribution.

Are Bitget's withdrawals still suspended?

Bitget suspended withdrawals following the breach as a containment measure while it assesses the incident. No confirmed timeline for restoring withdrawals was disclosed.

What is a hot wallet and why is it a target for hackers?

A hot wallet is a cryptocurrency wallet connected to the internet, used for faster transactions. Its connectivity makes it more vulnerable to hacking than offline cold storage wallets.