Bitget CEO Gracy Chen said a preliminary investigation found IP addresses matching VPN choices associated with a DPRK hacking group.

Bitget CEO Gracy Chen said North Korean hackers may be behind the exchange’s $351.6 million security breach on Thursday, citing preliminary findings linking IP addresses to VPN services used by a North Korean group.

Speaking during a live Q&A following the incident on X, Chen said security investigators had flagged similarities with previous North Korean attacks. She said the exchange did not believe the breach was an inside job.

“We’ve identified some IP addresses that match the VPN choices by a certain DPRK group,” Chen said, referring to the Democratic People’s Republic of Korea.

North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack, which the FBI attributed to North Korea.

Bitget CEO Gracy Chen hosts a live broadcast on X hours after the hack. Source: Bitget

“The pattern looks very much like what the North Korean team did before,” she said.

Chen also disclosed that hackers breached Bitget’s systems and transferred funds directly, rather than forging user withdrawal requests.

“They did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet,” she said.

Chen said investigators were still determining which systems were compromised and how the attackers gained access.

The comments come after Bitget reported unauthorized transfers affecting portions of its hot and warm wallet infrastructure on Thursday.

Source link