North Korean hackers linked to $352M Bitget crypto exchange hack
What's the story
Bitget, a leading cryptocurrency exchange, has flagged a possible link between North Korean hackers and a major security breach that affected about $351.6 million in digital assets. The suspicion stems from preliminary findings in an ongoing investigation into the incident. Bitget CEO Gracy Chen revealed that investigators have traced internet protocol (IP) addresses associated with VPN services previously used by a North Korean hacking group.
Attack similarities
Attack pattern resembles previous North Korean operations
Chen noted that the attack pattern closely resembles previous operations attributed to North Korea.
However, the exact method of intrusion into Bitget's systems is still being investigated.
The exchange detected unauthorized transfers from some wallets on Thursday afternoon (US time), involving 19 transfers across its hot and warm wallet infrastructure, while cold wallets remained secure.
Asset impact
Unauthorized transfers impacted multiple digital assets
The unauthorized transfers affected several digital assets including Ether, XRP, USDT, USDC, Avalanche, and BNB.
These assets were spread across different networks such as Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum.
Initial on-chain estimates had put the outflows at about $183 million but Bitget clarified that these analyzes did not account for activity across all affected blockchains.
Breach specifics
Breach has been contained, preventing further outflows
Bitget's security team discovered that the attacker had breached a critical backend wallet system, used it to spoof transfer information, and triggered Bitget's authorization-signing process.
Chen confirmed that the breach has been contained, preventing any further unauthorized outflows.
However, withdrawals are still on hold as technical teams work to repair and reinforce the affected systems.
Fund security
Customer balances are accurate, loss fully covered
Despite the massive loss, Bitget maintains that customer balances are accurate and the loss is fully covered by its User Protection Fund. This fund currently holds over $464 million.
As for future withdrawals, Chen said they could resume within hours or days but "shouldn't take weeks."