Both at and by can be used here, Jisu but I think there is a difference. Both are used when surprised means 'astonished', but usually only by is used when it means 'taken unaware' (as in Boo! ).
New words, one handy idiom, and a 2-minute quiz — delivered to your inbox to keep your streak alive.