Chainalysis has linked the majority of XRP stolen during the Bitget exchange hack to North Korea. The incident, which occurred on September 24, 2026, resulted in the loss of approximately $387.5 million from hot and warm wallets. This breach stands as the largest cryptocurrency exchange hack reported in 2026.
The attackers bypassed security by compromising a backend wallet system rather than stealing private keys, allowing them to spoof transaction data. The stolen funds were distributed across Ethereum, XRP Ledger, Zcash, and Tron. Approximately 103 million XRP, valued at $157 million, were taken in the initial transfers.
Chainalysis utilized AI tools to trace the funds, reducing manual bridge analysis time from over 20 hours to less than 10 minutes. Despite this, only about 0.2% of the stolen assets have been frozen. The theft contributes to a total of over $1 billion in suspected North Korean digital asset thefts in 2026.
Bitget CEO Gracy Chen identified a connection to North Korean groups shortly after the attack, a finding supported by investigations from TRM Labs and Elliptic. The exchange maintains a User Protection Fund valued at approximately $464 million and has pledged to use these assets to fully cover the losses for its customers.
