Bitget Blames North Korean Hackers for $387 Million Theft, Taps User Protection Fund for Restitution

Bitget, a global cryptocurrency exchange, announced that it believes North Korean cyber actors siphoned roughly $387 million from its platform, prompting the firm to activate a dedicated User Protection Fund to reimburse affected traders.

The company’s chief executive disclosed the allegation in a statement, saying the loss was detected through internal forensic analysis and that the stolen assets were moved through a series of anonymous wallets before disappearing from the exchange’s balance sheet.

North Korea has a documented history of targeting digital‑currency services to fund its weapons programs, with previous high‑profile breaches attributed to the Lazarus Group and affiliated units. The illicit appeal of crypto stems from its pseudonymous nature and the speed with which funds can be transferred across borders, making it a favored vector for state‑sponsored theft.

Bitget’s User Protection Fund, which holds more than $464 million, was established to safeguard client deposits against operational failures, security breaches, or other unforeseen events. The exchange said the fund will be drawn upon to fully compensate users whose holdings were compromised in the recent incident.

While the restitution plan aims to restore confidence among Bitget’s clientele, regulators in several jurisdictions have already signaled heightened scrutiny of crypto platforms’ security protocols and their capacity to absorb large‑scale losses.

Law‑enforcement agencies in the United States, South Korea, and other affected regions have been notified, and Bitget indicated it is cooperating with international investigators to trace the stolen funds and identify the perpetrators.

The episode adds to a growing list of cyber‑theft cases that have prompted exchanges to bolster internal controls, increase insurance coverage, and adopt more rigorous Know‑Your‑Customer (KYC) and anti‑money‑laundering (AML) measures.

Bitget has not provided a precise timetable for the reimbursement process but assures users that claims will be processed “as swiftly as possible” once verification is complete. The company also pledged to enhance its security architecture to prevent future incursions.

The investigation remains ongoing, and the extent to which the stolen cryptocurrency can be recovered is uncertain. Nonetheless, the incident underscores the persistent threat posed by state‑backed hacking groups to the rapidly expanding digital‑asset ecosystem.