Bitget attackers have converted most of the stolen funds on EVM chains into 67,982 ETH, worth approximately $183 million.

Bitget CEO Gracy Chen said during a live Q&A session on the crypto exchange’s security incident that preliminary investigations have found some related IP addresses match the VPN service used by a North Korean hacking group, and the attack pattern aligns with the group’s previous operations. As such, Bitget cannot rule out the group’s involvement in the attack, which involved approximately $351.6 million. However, attribution efforts remain in the preliminary stage. Chen noted that Bitget does not currently believe the incident was an inside job. Attackers directly breached the platform’s systems to transfer funds, did not forge user withdrawal requests, and did not obtain private keys for cold or hot wallets. Investigators are still working to confirm the specific affected systems and the attackers’ intrusion vector.

According to Lookonchain’s monitoring, a whale deposited 6,000 ETH, worth approximately $16.1 million, to OKX, Kraken, Gate, Bybit, and Binance one hour ago.

Whale 0xd0A4 deposited 6,000 $ETH($16.1M) into #OKX, #Kraken, #Gate, #Bybit, and #Binance an hour ago to sell.

Slow Mist’s MistTrack has updated the Bitget hacker wallet addresses, adding 7 Ripple network addresses with a combined balance of roughly 102,926,478 XRP, valued at approximately $157 million. The update also includes 11 EVM addresses and 1 TRON address. The EVM addresses collectively hold around 67,980.25 ETH, 5,896.58 BNB, 495.625 WETH, 218,022.9 USDT, and 99,989.9 USDC, while the TRON address holds approximately 20,593,376.5 TRX.

Bitget CEO Gracy Chen said in a live stream addressing the platform’s recent attack that some of the affected funds may be recoverable. On resuming withdrawals, Chen noted that Bitget must first thoroughly investigate the incident, with its technical team currently working on system repairs and security hardening. The withdrawal function will only be reactivated after the system is confirmed secure and resuming withdrawals is verified to not trigger further hacker attacks. She added that once a clear time window for withdrawal resumption is finalized, the platform will notify users and release an announcement immediately. No specific timeline can be committed to at present, as Bitget does not want to make unfulfillable promises.

Bitget CEO Gracy Chen stated during a live stream regarding the platform’s attack incident that the security team is currently focused on identifying the root cause and resolving the issue. Based on information available at this stage, the incident resembles a supply chain attack: attackers likely compromised a third-party tool frequently used by Bitget, thereby affecting a critical backend system of its wallet service. Chen noted that the compromised service forged transfer information and invoked a signing machine to siphon funds. The incident did not involve a private key leak; according to current investigations, the possibility of an insider job is also low. However, she added that the final attack vector still requires further confirmation from the security team. She further explained that hacker attacks are rarely single-type, with a single attack typically combining two to three of six to seven different tactics. Citing Bybit’s previous attack incident as an example, she noted that the case involved both the signature authorization process and a supply chain attack targeting the Safe multisig page it used. Common attack methods against crypto exchanges also include private key leaks, smart contract vulnerabilities, insider jobs, and social engineering attacks.