Chainalysis Ties $387 Million Bitget Breach to North Korea, Pushing 2026 Crypto Theft Past ...

Blockchain intelligence firm Chainalysis has formally attributed the September 24 breach of crypto exchange Bitget to hackers tied to North Korea, a conclusion that pushes the total value of cryptocurrency stolen by Pyongyang-linked groups in 2026 beyond $1 billion.

The firm detailed its findings in a report released October 1, describing how roughly $387 million was drained from Bitget's hot wallet and moved across four separate blockchains within the first three hours. Chainalysis said it worked alongside Bitget and law enforcement to trace the funds, deploying custom-built artificial intelligence tools that compressed what would have been more than 20 hours of manual bridge reconciliation into under 10 minutes.

The speed of the initial exodus underscored the sophistication of the operation. According to Chainalysis, the stolen funds left Bitget in 23 separate transfers and landed on four networks: Ethereum absorbed 49.7% of the outflows, the XRP Ledger took 40.8%, Zcash received 7.6%, and Tron accounted for the remaining 1.8%.

From there, the attackers routed the assets through cross-chain liquidity and messaging protocols, instant swap services, and laundering tools designed to obscure the trail. The stolen XRP drew particular scrutiny because of the route it took. Rather than sending the tokens to a centralized exchange, the attackers deposited them into a cross-chain liquidity protocol and withdrew Bitcoin on another network, a maneuver that bypassed traditional exchange surveillance while still leaving transaction records for investigators to examine.

Chainalysis said its analysts matched deposits with corresponding payouts across the protocols, following tens of millions of dollars over roughly 36 hours before the trail terminated at Bitcoin addresses now controlled by the attackers and placed under active monitoring.

The attribution aligns with earlier assessments from multiple parties. Bitget CEO Gracy Chen said shortly after the incident that the attack's patterns matched those of North Korean hackers, citing suspicious IP addresses connected to VPN services previously used by a DPRK-linked group. Blockchain analytics firm Elliptic separately called a North Korea link "highly likely."

Chainalysis emphasized that its AI tooling accelerated investigators rather than replacing them. Human analysts still defined the tracing logic, reviewed the outputs, and directed the overall investigation. The firm said a round-the-clock war room kept Bitget and law enforcement partners updated as the money moved, and within minutes of identifying stolen funds, compliance teams had access to labels flagging the affected addresses in Chainalysis's data platform.

"The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds," the firm said in its report.

North Korea-linked theft has been a defining theme of the crypto security landscape in 2026. The Bitget breach follows two major incidents in April that together cost approximately $577 million. On April 1, attackers drained $285 million from Drift Protocol after months of social engineering that included meetings with staff before compromising the approval process. Weeks later, KelpDAO suffered a $292 million bridge exploit on April 18, an operation that LayerZero linked to TraderTraitor, a North Korean threat group associated with the Lazarus collective.

TRM Labs said those two attacks represented 76% of crypto hack losses through April. In 2025, North Korean actors stole more than $2 billion from the crypto industry, according to Chainalysis estimates.

The Bitget incident itself became the largest crypto hack reported in 2026. PeckShield recorded $766.49 million in losses across 55 major hacks in September, roughly 462% above August's figure, with Bitget representing the single largest incident.

Bitget confirmed losses of approximately $387.5 million after revising its initial estimate, a change the exchange attributed to previously uncounted Zcash and Tron transfers rather than another wave of unauthorized withdrawals. The company said investigators had identified and fixed the underlying vulnerability and published attacker addresses to help other platforms monitor affected assets.

Independent analysis from Bitquery identified THORChain as one route used to convert stolen XRP, finding that by September 29 approximately 90.5% of the stolen XRP had been converted into Bitcoin. Swap records named destination assets and recipient addresses, helping connect payments across otherwise separate networks.

The investigation has drawn in multiple cybersecurity firms, including Mandiant and SlowMist. Bitget said industry coordination had already frozen some affected assets, and its recovery program offers bounties worth 5% of successfully frozen funds and 5% of recovered funds to eligible contributors.

Circle and Tether, the issuers behind the two largest stablecoins, froze roughly $318,000 in stablecoins tied to the attack. Meanwhile, swap services split in their response: Near Intents rejected more than $50 million in swaps tied to the hacker before itself being hacked days later for $3.8 million, while THORChain continued processing transactions.

Chainalysis said it will keep monitoring the stolen funds, labeling newly identified addresses and sharing intelligence with exchanges, issuers, and law enforcement partners. The firm noted that the intelligence can support efforts to identify, freeze, or block the stolen assets as the trail extends in the coming weeks.

The incident highlights a broader shift in how blockchain forensics firms respond to major exchange breaches. Manual bridge tracing has long been one of the slowest parts of any crypto hack investigation, as stolen funds are frequently split, swapped between assets, and routed through multiple bridges to obscure their origin. The ability to cut analysis time from 20 hours to minutes could materially change how quickly exchanges and compliance teams can respond to live incidents.

For the broader market, the attribution reinforces the persistent threat posed by state- actors to exchange security, custody infrastructure, and cross-chain bridges. It also strengthens the case for regulators and compliance teams to lean more heavily on AI-assisted blockchain analytics as a standard part of exchange security practice, even as North Korea-linked theft continues to grow in scale through 2026.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.