Chainalysis links $387 million Bitget hack to North Korean actors
This digest was compiled by AI from multiple sources — links to the originals are below.
Chainalysis attributed the $387 million hack of crypto exchange Bitget to North Korean-linked actors on October 3, 2026. The stolen funds moved across Ethereum, XRP, Zcash, Tron, and Bitcoin within 36 hours. The theft pushed total DPRK-linked crypto thefts in 2026 above $1 billion.
Key Facts
- Chainalysis attributed the $387 million Bitget hack to North Korean-linked actors.
- Within three hours, stolen funds moved through Ethereum, XRP, Zcash, and Tron in 23 transfers.
- Ethereum and XRP accounted for 49.7% and 40.8% of the stolen funds, respectively.
- Tens of millions of dollars in stolen XRP were converted to Bitcoin over roughly 36 hours.
- The Bitget hack pushed total DPRK-linked crypto thefts in 2026 above $1 billion.
Fund Movement
Chainalysis tracked the stolen assets across multiple networks shortly after the attack. Within the first three hours, the funds moved through Ethereum, XRP, Zcash, and Tron in 23 separate transfers. Ethereum and XRP accounted for the largest portions of the transfers, representing 49.7% and 40.8% of the stolen funds, respectively. The investigation identified activity involving cross-chain liquidity protocols, through which tens of millions of dollars worth of stolen XRP were moved into Bitcoin over roughly a day and a half.
DPRK-Linked Theft Total
Chainalysis' attribution places the Bitget incident within a broader series of cryptocurrency thefts associated with DPRK-linked actors. The Bitget hack has pushed the total value of crypto thefts linked to DPRK actors in 2026 above $1 billion. The figure covers thefts attributed to DPRK-linked activity during the year and places the Bitget incident among the largest such attacks tracked during the period.
2 sources
Time · lag behind first