Blockchain analytics firm Chainalysis has attributed the September 24 Bitget security breach to North Korea-linked actors, stating that the $387 million theft pushes total crypto losses from North Korean groups past $1 billion for 2026. The updated attribution follows earlier suspicions raised by Bitget CEO Gracy Chen, who pointed to suspicious IP addresses linked to VPN services previously used by a DPRK-affiliated hacking group.
Bitget subsequently revised its estimated losses to approximately $387.5 million, noting that the adjustment accounted for previously uncounted Zcash and Tron transfers rather than subsequent unauthorized withdrawals. The exchange stated that the underlying vulnerability has been fixed and published attacker addresses to assist other platforms.
Tracing the Funds Across Blockchains
Chainalysis identified 23 outbound transfers within the first three hours following the breach, with Ethereum accounting for 49.7% of the outflows, followed by the XRP Ledger at 40.8%, Zcash at 7.6%, and Tron at 1.8%. Rather than utilizing a centralized exchange account, the attackers moved stolen XRP through a cross-chain liquidity protocol to receive Bitcoin on a separate network, leaving blockchain records for investigators.
Independent analysis from Bitquery identified THORChain as a route used during the conversions, reporting that 90.5% of the stolen XRP was converted into Bitcoin by September 29. Chainalysis investigators tracked the funds over roughly 36 hours until the trail reached attacker-controlled Bitcoin addresses.
To accelerate the investigation, Chainalysis utilized custom automated tracing tools that reduced manual bridge reconciliation time from over 20 hours to under 10 minutes, while investigators continued to define tracing logic and review outputs.
Broader Industry Impact
The Bitget incident joins several major platform breaches linked to North Korea in 2026. In April, Drift Protocol suffered a $285 million drainage following social engineering attacks, while KelpDAO lost $292 million in a bridge exploit attributed by LayerZero to the Lazarus-associated threat group TraderTraitor. TRM reported that those two April incidents accounted for 76% of crypto hack losses through April.
Overall industry losses also spiked in September, with PeckShield recording $766.49 million across 55 major hacks—marking an increase of approximately 462% compared to August, largely driven by the Bitget breach.
The ongoing investigation involves cybersecurity firms Mandiant and SlowMist. Bitget announced that industry coordination has successfully frozen a portion of the affected assets and established a recovery program offering bounties worth 5% of successfully frozen funds and 5% of recovered funds to eligible contributors.
