$351 Million Digital Currency Heist on Bitget Traced to Suspected North Korean Actors

Bitget, a major cryptocurrency exchange, disclosed that it detected a massive unauthorized transfer of digital assets on September 24, amounting to roughly $351 million. The breach was identified by the platform's internal security monitoring, which flagged a series of large movements from user wallets to external addresses.

Following the detection, Bitget worked with blockchain analytics firms to trace the flow of the stolen funds. Several of the destination wallets have now been frozen by authorities, halting further dispersal of the assets. While the investigation is ongoing, early forensic evidence points to a group of addresses commonly associated with previous operations linked to North Korea.

North Korea’s cyber‑crime units, particularly the Lazarus Group, have a long‑standing reputation for targeting cryptocurrency platforms to fund the regime’s sanctioned‑bypass activities. Past incidents, such as the 2020 theft of $600 million from the Terra blockchain and the 2022 hack of a major DeFi protocol, have demonstrated a pattern of sophisticated, high‑value attacks. Security analysts note that the methodology observed in the Bitget case—rapid consolidation of funds and use of mixers—mirrors tactics employed in those earlier operations.

Industry experts say the incident underscores the growing vulnerability of crypto exchanges to state‑backed actors. Unlike typical cybercriminals, nation‑state groups can marshal extensive resources, including custom malware and zero‑day exploits, to bypass even advanced security layers. The scale of the Bitget loss also highlights the challenges regulators face in enforcing real‑time oversight across a borderless, pseudonymous financial ecosystem.

Bitget’s response includes a promise to reimburse affected users, though the exact mechanism remains under review. The exchange is also bolstering its security architecture, adding multi‑factor authentication and enhanced transaction monitoring. Meanwhile, law‑enforcement agencies in multiple jurisdictions have been alerted, and coordinated efforts are expected to pursue the frozen wallets and any downstream accounts. The incident serves as a stark reminder that, as cryptocurrency markets expand, they continue to attract the attention of sophisticated adversaries, prompting calls for tighter industry standards and international cooperation.