Blockchain intelligence firm Chainalysis has attributed the $387 million Bitget hot-wallet theft to North Korean actors, according to an October 1 report. The investigation traces stolen funds across four blockchains and pushes total crypto stolen by DPRK-linked groups in 2026 above $1 billion.
The breach occurred on September 24, when $387 million left Bitget in 23 transfers within three hours. Chainalysis found that Ethereum received 49.7% of the funds, XRP 40.8%, Zcash 7.6% and Tron 1.8%. Instead of routing stolen XRP directly to an exchange, attackers moved tens of millions of dollars through a cross-chain liquidity protocol and withdrew Bitcoin on the other side, a laundering path reconstructed in roughly a day and a half.
Hundreds of subsequent transfers have shuttled funds between networks such as Ethereum and Bitcoin through bridges, mixers and decentralized exchanges. Chainalysis used cross-chain attribution data built over more than a decade, alongside custom AI-assisted automation, to accelerate tracing. In one instance, more than 20 hours of manual bridge reconciliation was compressed to under 10 minutes. Investigators still defined the logic and reviewed outputs before directing the inquiry.
Bitget paused withdrawals after the breach and has been restoring services in phases since late September. Chainalysis said it will continue monitoring the stolen funds, labeling newly identified addresses and working with exchanges, issuers and law enforcement partners to identify, freeze or block assets. The incident is likely to intensify regulatory discussions around crypto security and exchange compliance.
