Chainalysis attributes $387 million Bitget theft to North Korean hackers

Chainalysis attributed the $387 million Bitget theft to North Korean hackers. Chainalysis said the attack brought the value of crypto stolen by North Korea-linked actors this year, 2026, above $1 billion. The theft ranks as 2026's largest crypto hack and increased September losses by 462%. Bitget CEO Gracy Chen had already pointed to North Korea shortly after the breach. Chen cited IP addresses that matched a North Korean group's VPN choices.

Chainalysis counted 23 outbound transfers in the first three hours after the September 24 exploit. The transfers spread $387 million across four blockchains. Ethereum received 49.7% of the outflows. The XRP Ledger received 40.8% of the outflows. Privacy-focused Zcash received 7.6% of the outflows. Tron received 1.8% of the outflows.

North Korean attackers reportedly used a cross-chain swap to convert stolen XRP into Bitcoin and kept the tokens away from exchanges. Chainalysis highlighted that the attackers deposited XRP into a cross-chain liquidity protocol instead of sending XRP to an exchange. The attackers then withdrew Bitcoin on another network. Chainalysis matched the deposits to their payouts. Tens of millions of dollars moved through this process over roughly 36 hours. The trail ended at attacker-controlled Bitcoin addresses that Chainalysis now monitors.

Chainalysis said the firm built custom automations with its in-house AI to accelerate cross-chain tracing. Chainalysis estimated that the automations reduced more than 20 hours of manual bridge reconciliation to under 10 minutes. Chainalysis added that investigators still set the logic and reviewed the results. Chainalysis said rapid identification and understanding of illicit activity are increasingly important because North Korea increasingly uses sophisticated automation to move and conceal stolen funds.

Bitget joins two April attacks that firms had already linked to North Korea. Hackers drained $285 million from Drift Protocol on April 1. Drift said the operation involved months of social engineering, including in-person meetings. Attackers took $292 million through a KelpDAO bridge exploit on April 18. TRM and LayerZero both linked the KelpDAO attack to TraderTraitor, a Lazarus-affiliated unit. TRM said the Drift Protocol and KelpDAO hacks accounted for 76% of all crypto hack losses through April. North Korean actors stole over $2 billion from the crypto industry in 2025.