Chainalysis Pins $387M Bitget Hack on North Korea

Blockchain analytics firm Chainalysis has attributed the $387 million Bitget exchange hack to North Korea, adding to the growing consensus that Pyongyang's hackers were behind one of the year's largest crypto thefts.

The report, published on Wednesday, says the breach on September 24 pushed the total value of crypto stolen by North Korea-linked groups in 2026 past $1 billion.

Chainalysis worked with Bitget and law enforcement to trace the funds across multiple blockchains, using in-house AI to speed up the process. The firm built custom automation that compressed over 20 hours of manual bridge reconciliation into under 10 minutes.

The stolen funds were quickly laundered through cross-chain liquidity and messaging protocols, instant swaps, and laundering services. Notably, the attackers used a cross-chain liquidity protocol to push the stolen XRP through to an attacker-controlled Bitcoin address.

Bitget CEO Gracy Chen said the attack's patterns matched North Korean hackers, and blockchain analytics firm Elliptic called a DPRK link 'highly likely'.