WuBlockchain
Chainalysis attributed the $387 million Bitget hack to DPRK-linked threat actors. In the first three hours, the stolen funds moved through 23 transfers across Ethereum, XRP, Zcash and Tron. Ethereum and XRP accounted for 49.7% and 40.8% of that early activity, respectively.
Why it matters
Investigators traced tens of millions of dollars in stolen XRP through cross-chain liquidity protocols into Bitcoin over roughly a day and a half. The movements show why following a major theft requires tracing assets across networks, not just monitoring the chain where funds first appeared.
Market impact
The attack has pushed DPRK-linked crypto thefts in 2026 above $1 billion. For investors, the scale of the Bitget loss and the speed of the transfers put exchange security and cross-chain tracing in focus.
Source: [How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget](https://www.chainalysis.com/blog/387m-bitget-theft-2026/)
Frequently asked questions
-
How quickly did the stolen Bitget funds move?
Chainalysis tracked 23 transfers across four chains in the first three hours after the $387 million hack.
-
Which chains carried the stolen funds in the first three hours?
The funds moved across Ethereum, XRP, Zcash and Tron. Ethereum and XRP accounted for 49.7% and 40.8% of the early activity, respectively.
-
How did investigators trace stolen XRP into Bitcoin?
Investigators followed tens of millions of dollars in stolen XRP through cross-chain liquidity protocols into Bitcoin over roughly a day and a half.
-
Who did Chainalysis link to the Bitget hack?
Chainalysis attributed the $387 million theft to DPRK-linked threat actors.
-
What does the Bitget theft mean for the 2026 DPRK-linked total?
The attack pushed DPRK-linked crypto thefts in 2026 above $1 billion.
CoinTelegraph
CryptoSlate
CoinDesk
TheBlock
Lookonchain