North Korea linked to $387M crypto hack

TLDR

A $387 million theft from exchange Bitget has now been widely attributed to North Korea linked hackers, making it one of 2026%%CKPROTECTED0%%s largest crypto hacks.

1. Blockchain analytics firm Chainalysis says the September 24 Bitget exploit, re-estimated at about $387.5 million, was carried out by DPRK-attributed threat actors, echoing earlier suspicions from Bitget and others.
2. Onchain traces show 23 transfers that spread funds across Ethereum, XRP, Zcash and Tron, with tens of millions in XRP converted to Bitcoin via cross-chain liquidity protocols such as THORChain.
3. The case pushes estimated 2026 North Korea linked crypto thefts above $1 billion, reinforcing both venue risk on centralized platforms and the importance of monitoring how stolen funds move across chains.

Deep Dive

1. What Happened At Bitget

Bitget suffered a security breach on 24 September in which attackers abused a backend wallet system to spoof transaction data and trigger unauthorized withdrawals from hot and warm wallets, while cold storage remained intact.

Bitget initially reported losses around $351.6 million, later revising the figure to roughly $387.5 million after including additional Zcash and Tron balances, making it the largest single crypto hack reported in 2026 so far. A later report from Chainalysis explicitly attributed the attack to DPRK?attributed threat actors, aligning with earlier comments from Bitgets CEO that IP patterns resembled prior North Korean operations and with analysis from Elliptic and other firms.

2. How The Hack Was Laundered

Investigators counted 23 outbound transfers in the first three hours after the breach, distributing about $387 million across Ethereum, the XRP Ledger, Zcash and Tron, with roughly half of the outflows going to Ethereum and about 41 percent to XRP.

Chainalysis and Bitquery describe how tens of millions in stolen XRP were then swapped into Bitcoin via a cross-chain liquidity protocol, identified by Bitquery as THORChain, by matching XRP deposits with corresponding Bitcoin payouts on the other side. Decrypt notes that this laundering pattern combined bridges, instant swaps and privacy tools, including Zcashs shielded pool, to obscure flows.

3. Broader Impact And What To Watch

Chainalysis says this single Bitget incident pushed 2026 North Korea linked crypto thefts above $1 billion, in a year already dominated by large hacks of Drift Protocol and KelpDAO that were also tied to DPRK affiliated groups. CryptoSlate highlights that five mega-breaches, led by Bitgets $387.5 million loss, account for a large share of 2026s nearly $2.7 billion in gross hack losses.

Bitget has stated that its User Protection Fund, with over $464 million in reserves, fully covers user balances, and has been restoring withdrawal functionality gradually while continuing to work with analytics firms and law enforcement. Onchain investigators such as ZachXBT report that laundering activity continues, with stolen funds moving through mixers and additional cross-chain bridges.

Conclusion

The Bitget theft shows how North Korea linked groups now combine social and infrastructure exploits with sophisticated cross-chain laundering to move hundreds of millions of dollars in hours.

For the broader market, the hack concentrates systemic risk in a handful of large venues and highlights that bridges, liquidity protocols and privacy tools are now central to both legitimate DeFi and high end criminal operations. Monitoring venue security, onchain movement of stolen funds and evolving regulatory responses will be key to understanding how this type of threat evolves.