Chainalysis Ties Bitget's $387M Hack to North Korea; XRP Moved to Bitcoin

The $387 million Bitget heist has been blamed by Chainalysis on North Korea-backed hackers. With that theft counted, Chainalysis said, DPRK-linked actors have now taken over $1 billion in crypto this year.

Reportedly, the North Korean hackers carried out a cross-chain swap that turned the stolen XRP into Bitcoin, keeping the coins off exchanges.

Bitget Joins Drift and KelpDAO on North Korea's List

Bitget now lines up alongside two April incidents that companies had previously connected to North Korea. On April 1, Drift Protocol saw $285 million siphoned out. Drift said months of social engineering, including face-to-face meetings, went into the operation.

A KelpDAO bridge exploit on April 18 cost the project $292 million. TRM and LayerZero each tied that incident to TraderTraitor, a unit connected to Lazarus.

Those two hacks combined accounted for 76% of all crypto hack losses up to April, according to TRM. Once Bitget's $387 million is counted, Chainalysis puts the 2026 haul at over $1 billion. North Korean actors took more than $2 billion from crypto in 2025.

Chainalysis said quicker tracing is increasingly necessary.

“The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds,” Chainalysis said.

Bitget CEO Gracy Chen had already pointed the finger at North Korea shortly after the breach. She cited IP addresses matching a DPRK group's VPN choices. The Bitget theft is also the biggest crypto hack of 2026, pushing September losses up 462%.

How Was the Stolen XRP Converted to Bitcoin With No Exchange Involved?

In the initial three hours after the September 24 exploit, Chainalysis logged 23 outgoing transfers. Those transactions spread $387 million across four blockchains.

Ethereum accounted for 49.7% of the outflows, close to half. The XRP Ledger received 40.8%, while privacy-focused Zcash and Tron got 7.6% and 1.8%, respectively.

Rather than sending the XRP to an exchange, the report noted, the attackers deposited it into a cross-chain liquidity protocol. From there, they withdrew Bitcoin on a different network.

Chainalysis connected those deposits to the corresponding payouts. For roughly 36 hours, tens of millions of dollars were shifted through this method. At the end of the trail sat Bitcoin addresses in the attackers' hands, and those addresses are now being watched by the firm.

Chainalysis also said it built custom automations with its internal AI to accelerate the cross-chain tracing. According to Chainalysis, the automation collapsed what would have been over 20 hours of manual bridge reconciliation into less than 10 minutes.

The company added that human investigators still set the logic and reviewed the findings.