Chainalysis attributed the $387 million Bitget hack to North Korean actors, tracing stolen XRP (XRP) into Bitcoin (BTC) through cross-chain liquidity.
Key Points:
- Attackers moved $387 million from Bitget in 23 transfers during the first three hours after the Sept. 24 exploit.
- Stolen XRP passed through a cross-chain liquidity protocol and emerged as Bitcoin without going through a centralized exchange.
- The Bitget theft pushed crypto stolen by North Korea-linked actors in 2026 above $1 billion.
Bitget Hack Trail
Chainalysis said $387 million left Bitget across 23 outbound transfers in the first three hours after the Sept. 24 breach.
The funds landed on four blockchains before the attackers began moving assets through cross-chain services and other onchain routes.
Ethereum (ETH) received 49.7% of the outflows, while the XRP Ledger received 40.8%. Zcash (ZEC) accounted for 7.6%, and Tron (TRX) received 1.8%.
Instead of sending the stolen XRP to an exchange, the attackers deposited it into a cross-chain liquidity protocol and withdrew Bitcoin on another network. Chainalysis matched deposits with payouts, tracing tens of millions of dollars over roughly 36 hours to attacker-controlled Bitcoin addresses.
Bitget CEO Gracy Chen had pointed to North Korea soon after the breach, citing IP addresses that she said matched VPN choices used by a DPRK group. The $387 million theft also became the largest crypto hack reported in 2026.
Also Read: Polymarket Kyiv Strike Bets Show $124,000 Volume, But Two Trades Explain It
Chainalysis DPRK Warning
Chainalysis said rapid tracing matters as attackers increasingly automate how stolen assets move across blockchains. “The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds,” the firm said.
The company used in-house AI to build custom tracing automations, reducing more than 20 hours of manual bridge reconciliation to under 10 minutes. Investigators still defined the logic, reviewed the output and directed the investigation.
The Bitget attribution pushed North Korea-linked crypto theft in 2026 above $1 billion. Earlier, hackers stole $285 million from Drift Protocol on Apr. 1 and $292 million through a KelpDAO bridge exploit on Apr. 18, attacks researchers also linked to North Korea.
TRM and LayerZero connected the KelpDAO attack to TraderTraitor, a Lazarus-affiliated unit, while TRM said the Drift and KelpDAO cases made up 76% of crypto hack losses through April. In 2025, DPRK-linked actors stole more than $2 billion from the crypto industry.
Read Next: Rogue AI Agents Force OpenAI Into A 50-Petabyte Search Of Its Own Records
