Bitget Hack Update: XRP, Bitcoin, and North Korean Link
Chainalysis has attributed the $387 million Bitget theft to North Korean hackers. The agency stated the assault lifts the worth of crypto stolen by DPRK-linked actors this yr above $1 billion.
North Korean attackers reportedly used a cross-chain swap to transform stolen XRP into Bitcoin and stored the tokens away from exchanges.
Drift, KelpDAO and Now Bitget
Bitget joins 2 April assaults that companies had already tied to North Korea. Hackers drained $285 million from Drift Protocol on April 1. Drift stated the operation involved months of social engineering, together with in-person conferences.
On April 18, attackers took $292 million via a KelpDAO bridge exploit. TRM and LayerZero each linked that attack to TraderTraitor, a Lazarus-affiliated unit.
Together, the two hacks made up 76% of all crypto hack losses via April, in accordance with TRM. Chainalysis stated Bitget’s $387 million brings the general 2026 haul to over $1 billion. In 2025, DPRK actors stole over $2 billion from the crypto business.
Chainalysis stated quicker tracing is changing into important.
“The means to rapidly establish and perceive illicit exercise is more and more necessary as North Korea more and more makes use of refined automation to maneuver and obscure stolen funds,” Chainalysis said.
Bitget CEO Gracy Chen had already pointed to North Korea shortly after the breach. She cited IP addresses that matched a DPRK group’s VPN selections. The theft additionally ranks as 2026’s largest crypto hack, lifting September losses 462%.
How Did Stolen XRP Become Bitcoin Without an Exchange?
Chainalysis counted 23 outbound transfers in the first 3 hours after the September 24 exploit. Together, they unfold $387 million throughout 4 blockchains.
Ethereum obtained almost half the outflows at 49.7%. The XRP Ledger took 40.8%, adopted by privacy-focused Zcash at 7.6% and Tron at 1.8%.
The report highlighted that as a substitute of sending the XRP to an alternate, the attackers deposited it right into a cross-chain liquidity protocol. They then withdrew Bitcoin on one other community.
Chainalysis matched these deposits to their payouts. Tens of tens of millions of {dollars} moved this fashion over roughly 36 hours. The path ended at attacker-controlled Bitcoin addresses the agency now screens.
Notably, the agency stated it constructed customized automations with its in-house AI to hurry up that cross-chain tracing. It estimated that greater than 20 hours of guide bridge reconciliation shrank to below 10 minutes.
Investigators nonetheless set the logic and reviewed the outcomes, Chainalysis added.
The publish Bitget Hack Update: XRP, Bitcoin, and North Korean Link appeared first on BeInCrypto.
