{"id":32782,"date":"2026-09-25T08:48:59","date_gmt":"2026-09-25T07:48:59","guid":{"rendered":"https:\/\/investx.fr\/en\/2026\/09\/25\/bybit-352m-hack-bitget-ceo-lazarus-group-north-korea\/"},"modified":"2026-09-25T08:49:05","modified_gmt":"2026-09-25T07:49:05","slug":"bybit-352m-hack-bitget-ceo-lazarus-group-north-korea","status":"publish","type":"post","link":"https:\/\/investx.fr\/en\/crypto-news\/bybit-352m-hack-bitget-ceo-lazarus-group-north-korea\/","title":{"rendered":"Bybit $352M Hack: Bitget CEO Points the Finger at North Korea’s Lazarus Group"},"content":{"rendered":"\n

A massive $352 million hack<\/strong> has struck the crypto ecosystem, and all eyes are now turning to Pyongyang. The CEO of Bitget<\/strong> has spoken out to confirm that losses are contained \u2014 but also to name a high-profile suspect: the Lazarus Group<\/strong>, North Korea’s state-sponsored cyber warfare unit.<\/p>\n\n\n\n

Behind this staggering figure lies an operation of rare sophistication, bearing all the hallmarks of a state-level actor<\/strong> with extensive experience exploiting crypto infrastructure at scale. Here is what we know so far.<\/p>\n\n\n\n

$352 Million Stolen: What We Know About the Attack<\/h2>\n\n\n\n

The hack, whose scale places it among the most significant incidents in recent crypto history, triggered an immediate response from Bitget<\/a><\/strong>. The platform’s CEO publicly confirmed that loss containment mechanisms<\/strong> were activated and that the situation is now under control. No precise technical details regarding the attack vector have been officially disclosed, but early on-chain analysis points toward a compromise of private keys<\/strong> or signing infrastructure.<\/p>\n\n\n\n

This type of attack \u2014 targeting the deepest security layers of an exchange directly \u2014 is the operational signature of the Lazarus Group<\/strong>. The stolen funds were rapidly dispersed across multiple addresses, a layering technique<\/strong> well documented in previous reports by Chainalysis<\/strong> and the United Nations<\/strong> on North Korean cybercriminal activity.<\/p>\n\n\n\n

At this stage, on-chain investigations conducted by several blockchain security firms are ongoing in an attempt to trace the fund flows and potentially freeze a portion of the assets on partner centralized exchanges.<\/p>\n\n\n\n

Lazarus Group: The Prime Suspect Behind Major Crypto Hacks<\/h2>\n\n\n\n

The Lazarus Group<\/strong> is no stranger to the crypto world. According to data compiled by Chainalysis<\/strong>, this North Korean state-affiliated hacking collective is believed to have stolen more than $3 billion<\/strong> in cryptocurrencies between 2017 and 2023. Among their most notable exploits: the Ronin Network bridge hack<\/strong> ($625M) in 2022 and the attack on Harmony Horizon<\/strong> ($100M).<\/p>\n\n\n\n

Their modus operandi is now well established: social engineering<\/strong> targeting developers, exploitation of vulnerabilities in smart contracts<\/strong> or custody infrastructure, followed by laundering through mixers such as Tornado Cash<\/strong> or intermediary chains. The CEO of Bitget<\/strong> stated that Lazarus involvement is “highly likely”<\/strong> \u2014 a carefully worded assessment that carries significant weight in the current geopolitical climate.<\/p>\n\n\n\n

This attribution, even if unofficial, raises a structural question for the entire industry: faced with state-level actors<\/strong> operating with virtually unlimited resources, are the current security standards of centralized exchanges<\/a> truly sufficient? US and European regulators may well seize on this incident to accelerate cybersecurity requirements for crypto platforms.<\/p>\n\n\n\n

What Are the Consequences for Trust in Centralized Exchanges?<\/h2>\n\n\n\n

Every hack of this magnitude reignites the fundamental debate between centralized custody and self-custody<\/strong>. While Bitget<\/a><\/strong> claims to have contained the losses \u2014 suggesting that user funds are not directly impacted thanks to the exchange’s reserves \u2014 the sector’s reputation takes yet another hit. Institutional investor confidence, already fragile following the FTX<\/strong> and Celsius<\/strong> collapses, remains a precious and hard-to-rebuild asset.<\/p>\n\n\n\n

On the market side, events of this nature typically generate short-term volatility<\/strong> in the affected assets, with mass withdrawals from platforms perceived as vulnerable. A growing number of users are temporarily migrating to cold wallet<\/strong> solutions in the hours following a major breach announcement.<\/p>\n\n\n\n

The incident also underscores the urgency for exchanges to strengthen their multi-signature<\/strong> protocols, MPC (Multi-Party Computation)<\/strong> frameworks, and regular third-party security audits<\/strong> \u2014 standards that the most serious players in the market are gradually adopting, though far from universally.<\/p>\n\n\n\n

\n\n\n\n

Related articles :<\/h3>\n\n\n\n