Bitget Says $351.6 Million Lost in Suspected North Korean Hack

Cryptocurrency exchange Bitget announced today that hackers have siphoned roughly $351.6 million from its hot and warm wallets, a breach it attributes to a group believed to be linked to North Korea. The loss, one of the largest in the sector this year, underscores the persistent vulnerability of digital‑asset platforms to well‑funded cyber‑crime operations.

Bitget, which offers spot and derivatives trading to a global user base, said the stolen funds were taken from a combination of hot wallets—online accounts used for immediate transaction processing—and warm wallets, which store assets offline for short periods. The distinction matters because hot wallets are more exposed to real‑time attacks, while warm wallets provide a limited buffer against theft.

Security analysts familiar with the incident note that the tactics resemble those employed by the Lazarus Group, a hacking collective widely reported to operate under the auspices of the North Korean regime. The group has previously targeted crypto exchanges, mining operations, and DeFi protocols, often moving stolen coins through a maze of mixers and peer‑to‑peer platforms to obscure their origin.

The breach arrives at a time when regulators worldwide are intensifying scrutiny of crypto‑related security practices. In the United States and Europe, authorities have urged exchanges to adopt stricter custodial standards, including multi‑signature controls and regular third‑party audits. Bitget has pledged to cooperate with law‑enforcement agencies and to conduct a forensic review of its security architecture, though it has not disclosed a timeline for restoring the compromised assets.

For investors, the incident serves as a reminder of the inherent risks of holding digital assets on centralized platforms. While exchanges like Bitget provide liquidity and convenience, they also concentrate large sums of value in single points of failure. Industry observers suggest that the episode may accelerate migration toward self‑custody solutions and heightened insurance coverage, as users seek to mitigate exposure to future attacks.