Bitget Hack Linked to North Korea, Total Crypto Theft Exceeds $1 Billion
The cryptocurrency exchange Bitget was hacked in a massive attack that saw $387 million in funds stolen. Chainalysis, a blockchain analytics firm, has linked the hack to threat actors connected to North Korea. The investigation found that the stolen assets moved across multiple blockchain networks, including Ethereum, XRP, Zcash, and Tron, within the first three hours of the attack.
The stolen funds were moved through Ethereum and XRP, representing 49.7% and 40.8% of the total, respectively. The movement of funds across several blockchain networks makes it challenging to track and recover the stolen assets. Chainalysis continued to investigate the movement of funds beyond their initial networks, identifying activity involving cross-chain liquidity protocols.
The investigation revealed that tens of millions of dollars worth of stolen XRP were moved into Bitcoin over a day and a half. This cross-chain movement indicates that the funds did not remain concentrated on a single blockchain following the attack. The attribution of the hack to DPRK-linked actors pushes the total value of crypto thefts linked to North Korea in 2026 above $1 billion.
Chainalysis' analysis focuses on transaction flows and the movement of stolen assets across public blockchain networks, allowing investigators to follow funds even after they are transferred between different chains. The investigation into the Bitget hack remains ongoing, with Chainalysis continuing to track the movement of stolen assets across networks.