Chainalysis has linked the $387 million theft from Bitget to North Korean hackers. This incident marks the largest crypto hack of 2026, contributing to a total of over $1 billion stolen by DPRK-linked actors this year. In 2025, these groups reportedly stole more than $2 billion from the industry.
The attackers executed the Bitget breach on September 24. Within three hours, they performed 23 outbound transfers, distributing funds across four blockchains: Ethereum received 49.7%, XRP Ledger 40.8%, Zcash 7.6%, and Tron 1.8%. The hackers used a cross-chain liquidity protocol to convert XRP into Bitcoin without using exchanges.
The movement of funds occurred over approximately 36 hours, ending at Bitcoin addresses controlled by the attackers. Chainalysis utilized custom AI-driven automation to track these cross-chain transactions, reducing the reconciliation time from over 20 hours to less than 10 minutes.
This incident follows other major attacks attributed to North Korean entities earlier in 2026, including the $285 million theft from Drift Protocol on April 1 and the $292 million exploit of KelpDAO on April 18. These two events accounted for 76% of all crypto hack losses through April.
