North Korea-linked hackers push theft past $1B

TLDR

North Korea-linked hacking groups have now stolen more than $1 billion in crypto in 2026, driven by a massive new exploit of the Bitget exchange.

1. Chainalysis says the $387 million Bitget hack pushed DPRK-linked crypto thefts this year over $1 billion, after earlier attacks on Drift and KelpDAO.
2. The groups use increasingly sophisticated cross-chain laundering, swapping stolen XRP into Bitcoin via protocols like THORChain to avoid centralized exchanges.
3. Crypto users face rising venue and bridge risk, and regulators and analytics firms are stepping up tracing and freeze actions, though recoveries remain small.

Deep Dive

1. Scale Of Theft And The Bitget Hit

Blockchain analytics firm Chainalysis attributed the 24 Sep exploit of Bitget, where about $387 million was drained, to DPRK-attributed threat actors, and said this single incident pushed its tally of 2026 North Korea-linked crypto thefts above $1 billion so far. The updated Bitget loss estimate of roughly $387.5 million spans assets across several chains, including XRP, Ethereum, Zcash, and Tron, and is described in detail by Chainalysis and Bitget coverage.

This follows earlier 2026 hacks already linked to North Korean units: about $285 million from Drift Protocol and roughly $292 million via a KelpDAO bridge exploit, together accounting for most hack losses through April in one analysis.

2. How The Hackers Move Stolen Funds

Investigators report that the Bitget attackers rapidly spread funds using 23 transfers in the first three hours to multiple networks, then laundered tens of millions of dollars in XRP through a cross-chain liquidity protocol and withdrew Bitcoin on another chain, a pattern detailed in Chainalysis AI-assisted tracing report.

Bitquery and others identified THORChain as a key route, with over 90% of the stolen XRP swapped into BTC according to follow-up on-chain analysis. Stablecoin issuers and protocols have frozen some funds, but those amounts are small relative to the total.

3. Impact On Exchanges And Everyday Users

Bitget has said the breach involved hot and warm wallet infrastructure and a third-party security product, while cold wallets and core keys remained secure, highlighting operational and vendor risk on centralized venues.

For users, the main practical risks are venue failure, withdrawal delays, and potential pressure on protocols that become favored laundering routes. Large, sophisticated state actors are now a baseline adversary, not an edge case, which may influence how regulators treat exchange security, bridge design, and cross-chain DeFi.

Conclusion

North Korea-linked hacking crews have turned large-scale crypto theft into a repeatable operation, now exceeding $1 billion in 2026 alone, with Bitget the latest and largest victim. Their use of advanced cross-chain laundering raises the bar for defenses, pushing exchanges, protocols, and regulators toward tighter security and faster tracing, while leaving users with a persistent background risk that needs to be factored into how and where they hold assets.