Assets worth $351.6 million flowed from the cryptocurrency exchange. Payments suspended
Bitget detected 19 unauthorized transfers. The value of assets affected by the incident was estimated at $351.6 million, and payments were suspended.
On September 24, the Bitget cryptocurrency exchange detected unauthorized transfers from some of the wallets used in its infrastructure. According to the company’s general manager, Gracy Chen, these were 19 transfers made from the most active wallets. The so-called cold wallets were not affected.
According to Bitget estimates, the total value of assets affected by the incident is approximately $351.6 million. The first analyzes of transactions in blockchains indicated an outflow of approximately USD 183 million, but – as the exchange emphasizes – these calculations did not take into account all the networks involved in the event.
Attack on the Bitget exchange. A North Korean thread has emerged
Initial findings by investigators indicate the possible involvement of hacking groups linked to North Korea. Chen said IP addresses associated with VPN services previously used by the North Korean hacking group had been identified.
According to the information provided by the head of Bitget, the attack pattern was also similar to previous operations attributed to this country. However, this is still suspected at this stage – the exact method used by the attackers is still being analyzed.
The hackers were supposed to get into the back-end system
Bitget claims that the attackers gained access to a key back-end system responsible for handling wallets. They then allegedly used it to manipulate transfer data and trigger the authorization process.
At the same time, Chen said that the possibility of private key compromise had been ruled out. The exchange also assures that the incident has been brought under control and there are no further unauthorized outflows of funds.
Payments have been suspended
After detecting the attack, Bitget decided to suspend withdrawals. The restriction is to apply until the works related to securing the infrastructure are completed. At the same time, trading and deposits are expected to function normally.
No exact date has been given for the resumption of withdrawals. Chen estimated that the work should take a few hours or days at most, not weeks.
Bitget announces coverage of losses
The exchange ensures that customer balances remain correct. Losses resulting from the incident are to be fully covered from the User Protection Fund. According to Chen, its value exceeds $464 million.
After the attack, Bybit also offered help. Its CEO Ben Zhou announced an update to the LazarusBounty platform to help identify and track stolen assets. Bybit itself fell victim to an attack in February 2025 in which cryptocurrencies worth approximately $1.5 billion were stolen.
