Bitget’s CEO Gracy Chen said preliminary investigation points to North Korean hackers behind the exchange’s reported $351.6 million security breach on Thursday. Speaking during a live Q&A on X shortly after the incident, Chen said investigators identified IP addresses they believe align with VPN services used by a DPRK-linked group.

Chen also said Bitget does not believe the breach involved an insider. She added that investigators were still mapping which parts of the exchange’s infrastructure were compromised and how the attackers gained access.

Key takeaways

Bitget CEO Gracy Chen said preliminary findings link the attack to IP addresses associated with VPN choices used by a DPRK group.
Chen said the exchange does not think the incident was carried out by an insider.
Bitget indicated hackers moved funds directly, rather than forging user withdrawal requests.
Withdrawals remained suspended at the time of publication, while Bitget works with partners on recovery efforts.

CEO points to VPN-linked IP addresses

In the Q&A, Chen told viewers that security investigators had flagged similarities between this incident and past DPRK-linked activity. She specifically referred to “some IP addresses” that match the VPN services reportedly used by the group.

Chen’s remarks described the attribution as preliminary, framed around technical indicators rather than a final, court-grade conclusion. Still, her comments reinforce a broader pattern the crypto industry has seen across multiple high-profile incidents, where infrastructure-level traces and operational “fingerprints” are used to connect attacks to specific threat actors.

Chen also said the investigation is ongoing, including efforts to determine which systems were affected and the precise entry point attackers used. That matters for users and market participants because identifying the initial access vector typically influences what remedial actions are prioritized—such as credential resets, segmentation changes, or controls around administrative interfaces.

How the breach reportedly worked

Beyond attribution, Chen offered details about the mechanics of the theft. She said hackers breached Bitget’s systems and transferred funds directly instead of forging user withdrawal instructions.

According to Chen, attackers “did not forge user withdrawal requests,” and she said they did not obtain Bitget’s private keys for any cold wallet or hot/warm wallet. Those distinctions are important because they suggest the compromise may not have relied on the same controls-behavior that some other incidents have shown, even if the ultimate outcome—unauthorized transfers—was severe.

Chen said investigators were still determining which systems were compromised. Until that scope is clear, it remains difficult for external observers to assess whether this was limited to particular services (for example, withdrawal-related infrastructure) or whether the breach potentially affected other operational components. For users, that uncertainty is reflected in the exchange’s decision at the time of publication to keep withdrawals suspended.

Bitget’s reported unauthorized transfers affected portions of its hot and warm wallet infrastructure, according to the exchange’s earlier disclosures. Withdrawals were still suspended at the time the CEO’s comments were reported.

Recovery efforts underway, but amounts not disclosed

During the Q&A, Chen said that some of the stolen funds had been recovered. She did not provide an amount, but said Bitget is working with blockchain foundations and other partners on recovery efforts.

Without a disclosed figure, observers will likely focus on whether recovery is partial or extensive—and, crucially, whether the attackers’ remaining funds are successfully identified and potentially blocked or reclaimed. The effectiveness of these efforts can vary significantly depending on factors such as how quickly assets are frozen, how the funds are routed through intermediaries, and whether counterparties and analytics teams are engaged promptly.

The broader market context also matters. If attribution strengthens—especially when aligned with prior patterns linked to DPRK-associated groups—it may influence how institutions assess counterparty risk and how exchanges harden controls related to suspicious network behavior and wallet-operation workflows.

DPRK links follow a pattern of major thefts

Chen’s comments come amid a long-running attribution debate in the crypto space, where North Korea-linked groups have frequently been referenced in connection with large-scale cyber thefts and laundering activity.

In earlier reporting, Cointelegraph described an estimated $2.02 billion in crypto theft attributed to North Korean actors in 2025, including a roughly $1.5 billion Bybit hack that the FBI attributed to North Korea. Cointelegraph also linked those broader estimates to “South Korea gets rich from crypto” reporting that framed North Korean activity in the context of weapons-related incentives.

Chen’s statement that the “pattern looks very much like what the North Korean team did before” suggests Bitget is interpreting technical and behavioral indicators through that existing lens. However, the exchange’s own caveat—she described findings as preliminary and said investigators were still working out the full compromise path—means readers should expect updates as more information becomes available.

For investors and traders, the immediate concern is not only the size of the breach, but the robustness of the exchange’s controls and the completeness of remediation. For builders and security teams, the incident underscores a recurring theme: even when private keys remain uncompromised, attackers may still succeed by compromising operational systems that can authorize or execute transfers.

Next, the key developments to watch are Bitget’s investigation findings on exactly which systems were breached, whether the exchange expands its recovery estimate beyond “some” funds, and when—if at all—withdrawals resume after the affected hot/warm infrastructure is stabilized.