Chainalysis Links the $387M Bitget Hack to North Korea: What It Means for Crypto Holders

What Chainalysis found

On October 1, Chainalysis published its analysis of the Bitget theft and attributed it to DPRK-linked hackers. The firm does not name a specific group and does not disclose technical details of the breach. Others had reached the same conclusion earlier: Bitget CEO Gracy Chen pointed to IP address and VPN overlaps with North Korean hackers, and Elliptic analysts, based on the laundering pattern, pointed to the TraderTraitor group and called a DPRK link highly likely. No government has officially announced an attribution yet.

We have already covered the breach itself. The attackers got into Bitget's internal network back on August 31 through a vulnerability in a third-party security product, stayed undetected for almost a month, and on September 24 sent the wallet system spoofed withdrawal commands. No private keys were stolen. After the attack, withdrawals stayed frozen for several days, so coins could not be sent to a personal wallet, another trading platform or an instant crypto exchange. We described the first hours in our story on how $351 million was drained from Bitget hot wallets.

According to Chainalysis, with Bitget included, hackers linked to North Korea have stolen more than $1 billion in crypto in 2026. Elliptic gives the same milestone and calls Bitget the largest suspected North Korean theft of the year.

Where the $387 million went

The money moved fast. Within the first three hours $387 million left the exchange in 23 transfers, split across four blockchains:

Almost half went to Ethereum and about 40% more to the XRP network. Zcash and Tron together account for less than a tenth.

The Zcash network has two kinds of addresses: transparent and shielded. Transfers between transparent addresses are public, just like in Bitcoin: sender, recipient and amount. Analytics tools read them the same way they read Ethereum or Tron, which is why Chainalysis traced the 7.6% on Zcash along with the other chains.

Why the first estimate was $351 million

On the first day Bitget put the loss at $351.6 million. On September 25 the exchange raised its estimate to $387.5 million after adding transfers on Zcash and Tron. The gap is almost exactly the share of those two chains in the Chainalysis breakdown: 9.4% of $387.5 million is about $36 million. So the higher figure does not mean a second theft; Chainalysis counts the full picture of transfers to all four chains.

How AI helped untangle the bridges

The most labor-intensive part of an investigation like this is cross-chain bridges. Coins enter a bridge on one chain and leave on another, and an investigator has to work out which exit matches which entry. Usually that means manually reconciling timestamps, amounts and fees across thousands of rows.

Chainalysis says its in-house AI cut this work from more than 20 hours to under 10 minutes. Investigators set the matching logic, reviewed the results and directed the case, while the model handled the routine: pairing a deposit on one chain with a payout on another. Speed matters a lot here. The sooner the destination addresses are known, the better the chance that a stablecoin issuer or an exchange can freeze the funds in time.

How the stolen funds are laundered

Chainalysis describes the attackers' tools in general terms: cross-chain liquidity and messaging protocols, instant swap services and laundering services. Centralized exchanges play almost no part in this scheme.

The XRP trail is the clearest. The attackers ran the coins through a cross-chain liquidity protocol and, over roughly 36 hours, took bitcoin out the other side, which landed on addresses they control. Chainalysis is monitoring those addresses. The firm does not name the protocol; media reports point to THORChain. According to Lookonchain, the attacker was already using it to swap stolen ether for bitcoin on September 28.

Little has been stopped so far. Circle and Tether blacklisted the attacker's Ethereum address and froze about $318,000 in USDC and the USDT stablecoin. NEAR Intents rejected more than $50 million in swaps tied to the hacker. THORChain did not act on Bitget's request to reject those swaps and kept processing transfers. The other big thefts of last month are collected in our overview of how much crypto was stolen from exchanges and protocols in September 2026.

What it means for an ordinary holder

Stolen coins are labeled

Chainalysis has labeled the addresses the Bitget funds passed through in its platform and says it will keep monitoring the funds and sharing intelligence with other investigators. Exchanges and stablecoin issuers use such databases: incoming transfers are checked against the labels, and a link to stolen funds is a reason to hold a deposit and ask questions.

For an ordinary person the takeaway is simple. Coins from a hack get split up and change hands, and they can reach someone who has never even heard of Bitget, for example in a P2P deal with a stranger. If you later send those coins to an exchange, the deposit can be frozen pending review, and it is the owner who has to prove where the money came from. That is why it makes sense to accept large amounts only from people you know and to keep a record of your transfers: transaction hashes and withdrawal statements.

Bitget customer funds are safe

These labels do not affect customer balances. The money was stolen from the exchange's own hot and warm wallets, and cold storage was not touched. In a live stream after the hack, Bitget said its user protection fund of about $464 million covers the entire loss, and that the exchange's own funds together with the fund exceed $1.4 billion. More details are in our recap of what Bitget said about the hack in its AMA. The exchange reopened withdrawals in stages, and the last one on its schedule fell on October 2: remaining tokens, fiat and P2P.

An exchange holds your coins for you

Bitget customers lost nothing in the end, yet they could not withdraw bitcoin for four days and some other coins for eight. An exchange balance is the platform's promise to pay you back, and it can keep that promise only while its servers, contractors and reserves hold up. Keeping a trading amount there is convenient, but savings are safer with you. If the difference is not obvious yet, start with our article on how a non-custodial wallet differs from an exchange account. Once you have a wallet, the main concern is the recovery phrase: a separate guide covers how to store a seed phrase so you never lose access to your coins.

If you still have stablecoins on an exchange and want to hold your reserve in bitcoin at your own address, you can exchange USDT TRC20 to BTC straight to your own wallet. VertEXchange has no accounts and no balances: you enter your address, send your coins and receive the other coins directly to it.