North Korea hackers drain $387M from exchange

TLDR

North Korea-linked hackers are reported to have stolen about $387 million from crypto exchange Bitget, in one of 2026%%CKPROTECTED0%%s largest crypto hacks.

1. Blockchain firm Chainalysis has attributed Bitget's $387 million loss to DPRK-linked actors, pushing their 2026 crypto haul above $1 billion.
2. Attackers compromised Bitget's hot and warm wallets, draining funds across four chains, then converted large XRP positions into Bitcoin via cross-chain liquidity protocols.
3. The incident highlights rising cross-chain laundering sophistication and reminds users that centralized exchanges carry real counterparty and operational risk.

Deep Dive

1. Attribution To North Korea

Chainalysis and other investigators have linked Bitget's 387 million breach to North Korea-associated groups using on-chain tracing and operational fingerprints such as VPN patterns.

Their analysis says the theft pushes crypto stolen by DPRK-linked actors in 2026 above $1 billion, after already exceeding $2 billion in 2025. This fits a multi-year pattern of North Korean units targeting exchanges, bridges, and DeFi protocols rather than retail users.

Earlier 2026 attacks on Drift Protocol and a KelpDAO bridge, also tied to DPRK-linked traders, had already contributed hundreds of millions to those totals, so Bitget is part of a broader campaign rather than an isolated case.

2. How The Bitget Hack Worked

Bitget reported that unauthorized withdrawals were detected on September 24 from parts of its hot and warm wallet infrastructure, while cold wallets and private keys remained intact. A compromised backend plus a vulnerability in a third-party security product allegedly let attackers forge withdrawal commands.

Within the first three hours, Chainalysis recorded 23 transfers moving about $387 million off the platform, with roughly 49.7 percent to Ethereum, 40.8 percent to the XRP Ledger, 7.6 percent to Zcash, and 1.8 percent to Tron. Investigators then traced tens of millions in stolen XRP through a cross-chain liquidity protocol where it was swapped into Bitcoin and sent to attacker-controlled addresses under monitoring.

Bitget has said it is working with law enforcement and analytics firms, has a protection fund reported above $300 million, and has offered a 5 percent bounty for help in freezing or recovering funds. Some stablecoins linked to the hack have already been frozen by issuers, limiting a small portion of the damage.

3. Implications For Users And Market

This hack underlines that keeping assets on centralized exchanges exposes users to operational security failures and third-party tooling risks, even when cold storage and formal reserves exist.

It also shows how attackers increasingly rely on cross-chain bridges, instant swaps, and privacy-focused chains like Zcash to quickly obscure flows, which makes timely tracing and freezing crucial.

Conclusion

North Korea-linked groups turning Bitget's security lapse into a $387 million haul illustrates how sophisticated, well resourced actors target centralized chokepoints in crypto. The combination of backend compromise, cross-chain obfuscation, and rapid laundering raises the bar for exchanges and analytics firms alike. For users, the main takeaway is not a specific price impact but a renewed focus on venue risk, cross-chain attack surfaces, and how quickly platforms can detect, disclose, and contain large scale breaches.