Chainalysis has attributed the $387 million Bitget theft to North Korean hackers. The firm said the attack lifts the value of crypto stolen by DPRK-linked actors this year above $1 billion.
North Korean attackers reportedly used a cross-chain swap to convert stolen XRP into Bitcoin and kept the tokens away from exchanges.
Drift, KelpDAO and Now Bitget
Bitget joins 2 April attacks that firms had already tied to North Korea. Hackers drained $285 million from Drift Protocol on April 1. Drift said the operation involved months of social engineering, including in-person meetings.
On April 18, attackers took $292 million through a KelpDAO bridge exploit. TRM and LayerZero both linked that attack to TraderTraitor, a Lazarus-affiliated unit.
Together, the 2 hacks made up 76% of all crypto hack losses through April, according to TRM. Chainalysis said Bitget’s $387 million brings the overall 2026 haul to over $1 billion. In 2025, DPRK actors stole over $2 billion from the crypto industry.
Chainalysis said faster tracing is becoming essential.
“The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds,” Chainalysis said.
Bitget CEO Gracy Chen had already pointed to North Korea shortly after the breach. She cited IP addresses that matched a DPRK group’s VPN choices. The theft also ranks as 2026’s largest crypto hack, lifting September losses 462%.
How Did Stolen XRP Become Bitcoin Without an Exchange?
Chainalysis counted 23 outbound transfers in the first 3 hours after the September 24 exploit. Together, they spread $387 million across 4 blockchains.
Ethereum received nearly half the outflows at 49.7%. The XRP Ledger took 40.8%, followed by privacy-focused Zcash at 7.6% and Tron at 1.8%.
The report highlighted that instead of sending the XRP to an exchange, the attackers deposited it into a cross-chain liquidity protocol. They then withdrew Bitcoin on another network.
Chainalysis matched those deposits to their payouts. Tens of millions of dollars moved this way over roughly 36 hours. The trail ended at attacker-controlled Bitcoin addresses the firm now monitors.
Notably, the firm said it built custom automations with its in-house AI to speed up that cross-chain tracing. It estimated that more than 20 hours of manual bridge reconciliation shrank to under 10 minutes.
Investigators still set the logic and reviewed the results, Chainalysis added.
