Chainalysis Ties $387 Million Bitget Breach to North Korea, Pushing 2026 Crypto Theft Past $1 Billion

Blockchain intelligence firm Chainalysis has formally attributed the September 24 breach of crypto exchange Bitget to hackers tied to North Korea, a conclusion that pushes the total value of cryptocurrency stolen by Pyongyang-linked groups in 2026 beyond $1 billion.

The firm detailed its findings in a report released October 1, describing how roughly $387 million was drained from Bitget's hot wallet and moved across four separate blockchains within the first three hours. Chainalysis said it worked alongside Bitget and law enforcement to trace the funds, deploying custom-built artificial intelligence tools that compressed what would have been more than 20 hours of manual bridge reconciliation into under 10 minutes.

The speed of the initial exodus underscored the sophistication of the operation. According to Chainalysis, the stolen funds left Bitget in 23 separate transfers and landed on four networks: Ethereum absorbed 49.7% of the outflows, the XRP Ledger took 40.8%, Zcash received 7.6%, and Tron accounted for the remaining 1.8%.

From there, the attackers routed the assets through cross-chain liquidity and messaging protocols, instant swap services, and laundering tools designed to obscure the trail. The stolen XRP drew particular scrutiny because of the route it took. Rather than sending the tokens to a centralized exchange, the attackers deposited them into a cross-chain liquidity protocol and withdrew Bitcoin on another network, a maneuver that bypassed traditional exchange surveillance while still leaving transaction records for investigators to examine.