Chainalysis links Bitget's $387M breach to North Korean hackers
Security & Exploits ·
Blockchain analytics firm traced the stolen funds across four networks within hours, pushing 2026's DPRK-linked crypto theft total past $1 billion.
Chainalysis has attributed the $387 million hack of Bitget to threat actors linked to North Korea, according to an analysis reported by WuBlockchain. The firm's tracing shows the attackers moved quickly to obscure the funds' origin, spreading them across multiple blockchains almost immediately after the breach.
Within the first three hours, the stolen assets passed through 23 separate transfers across Ethereum, XRP, Zcash and Tron. Ethereum accounted for the largest share of the movement at 49.7%, with XRP close behind at 40.8%, leaving Zcash and Tron handling the remainder of the initial dispersal.
Investigators did not stop at the first hop. Chainalysis traced tens of millions of dollars in stolen XRP as it moved through cross-chain liquidity protocols and eventually into Bitcoin, a process that unfolded over roughly a day and a half. The use of cross-chain protocols and multiple networks in rapid succession reflects a laundering pattern that has become a hallmark of DPRK-linked operations, designed to fragment the trail before funds can be frozen or traced by exchanges and investigators.
The Bitget incident adds significantly to the scale of North Korea-linked crypto theft this year. With this hack included, total DPRK-linked crypto thefts in 2026 have climbed above $1 billion, according to the same Chainalysis findings cited by WuBlockchain. A separate account in the same cluster corroborates the core attribution, confirming that North Korean hackers were responsible for the breach.
What remains unclear is how much of the stolen $387 million, or the broader tens of millions in traced XRP, has since been frozen, recovered, or converted into untraceable assets beyond the Bitcoin endpoint. Also unresolved is whether Bitget or other exchanges will face further exposure from the same actors, given the pace at which DPRK-linked thefts have accumulated across 2026.