Blockchain analysis firm Chainalysis has attributed the $387 million Bitget theft to North Korean hackers. According to the firm, this attack pushes the total value of cryptocurrency stolen by Democratic People's Republic of Korea (DPRK)-linked actors this year above $1 billion.
Bitget CEO Gracy Chen had previously pointed to North Korea shortly after the breach, citing IP addresses matching the VPN choices of a DPRK group. The theft stands as the largest crypto hack of 2026, causing September losses to surge by 462%.
Cross-Chain Swaps and Fund Distribution
Chainalysis tracked 23 outbound transfers during the first three hours following the September 24 exploit, distributing the $387 million across four blockchains:
- Ethereum: 49.7% of outflows
- XRP Ledger: 40.8% of outflows
- Zcash: 7.6% of outflows
- Tron: 1.8% of outflows
Instead of routing the stolen XRP through centralized exchanges, the attackers used a cross-chain liquidity protocol to deposit the assets and withdraw Bitcoin on an alternative network. Tens of millions of dollars moved through this method over approximately 36 hours before landing in attacker-controlled Bitcoin addresses that Chainalysis continues to monitor.
To trace the cross-chain activity, Chainalysis utilized custom automations, reducing a manual bridge reconciliation process that typically takes over 20 hours down to less than 10 minutes, with investigators setting the logic and reviewing the final results.
Broader Context of DPRK-Linked Hacks
The Bitget incident follows major hacks earlier in the year that firms also linked to North Korea, including a $285 million drainage of Drift Protocol on April 1 and a $292 million KelpDAO bridge exploit on April 18. TRM and LayerZero previously associated the KelpDAO exploit with TraderTraitor, a unit affiliated with the Lazarus Group.
TRM reported that the Drift and KelpDAO incidents accounted for 76% of all crypto hack losses through April. In comparison, DPRK actors stole over $2 billion from the crypto industry in 2025.
Highlighting the changing landscape of illicit activity, Chainalysis emphasized that faster tracing is becoming essential as North Korea increasingly relies on sophisticated automation to move and obscure stolen funds.
