Bitget CEO Gracy Chen said North Korean hackers may be behind the exchange’s $351.6 million security breach on Thursday, citing preliminary findings linking IP addresses to VPN services used by a North Korean group. 

Speaking during a live Q&A following the incident on X, Chen said security investigators had flagged similarities with previous North Korean attacks. She said the exchange did not believe the breach was an inside job. 

“We’ve identified some IP addresses that match the VPN choices by a certain DPRK group,” Chen said, referring to the Democratic People’s Republic of Korea.

North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack, which the FBI attributed to North Korea. 

Bitget CEO Gracy Chen hosts a live broadcast on X hours after the hack. Source: Bitget

“The pattern looks very much like what the North Korean team did before,” she said.

Chen also disclosed that hackers breached Bitget’s systems and transferred funds directly, rather than forging user withdrawal requests.

“They did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet,” she said. 

Chen said investigators were still determining which systems were compromised and how the attackers gained access.

Related: Bitget confirms $352M security breach, suspends withdrawals

The comments come after Bitget reported unauthorized transfers affecting portions of its hot and warm wallet infrastructure on Thursday. Withdrawals remain suspended at the time of publication.

During the Q&A, Chen also said some stolen funds had been recovered, without specifying an amount. She said the exchange was working with blockchain foundations and other partners on recovery efforts.

Magazine: Asia dominates Crypto Adoption Index, Bitget’s $351M hack: Asia Express