Chainalysis Attributes $387M Bitget Hack to North Korea as 2026 Thefts Top $1B

Chainalysis attributed the $387 million Bitget hot-wallet theft to North Korean actors in an October 1 report, tracing the stolen funds across four blockchains and pushing the value of crypto stolen by DPRK-linked groups in 2026 past $1 billion, according to the blockchain intelligence firm. Bitget paused withdrawals after the breach and has been restoring services in phases since late September. The findings offer the most detailed public account yet of how the funds left the exchange on September 24.

How the stolen funds moved

Within three hours of the exploit, $387 million left Bitget in 23 transfers and landed on four chains, Chainalysis said: Ethereum received 49.7% of the funds, XRP 40.8%, Zcash 7.6% and Tron 1.8%. Rather than routing the stolen XRP to an exchange, the attackers pushed tens of millions of dollars through a cross-chain liquidity protocol and pulled Bitcoin out the other side, a laundering path Chainalysis reconstructed over roughly a day and a half by matching deposits to their corresponding payouts. The firm said hundreds of transfers have followed the initial exodus, with funds repeatedly shuttled between networks such as Ethereum and Bitcoin through bridges, mixers and decentralized exchanges. Investigators drew on cross-chain attribution data built over more than a decade to match deposits and payouts across different protocols.