Chainalysis attributes $387 million Bitget hack to North Korea, with 40.8% moved to the XRP Ledger

Blockchain analytics firm Chainalysis has attributed the $387 million drained from crypto exchange Bitget on Sept. 24 to North Korea. In a blog post published Oct. 1 (U.S. time), the company described the attack as "DPRK-attributed" and said the theft pushes the total value of crypto stolen by North Korea-attributed actors in 2026 past $1 billion. Chainalysis said it is working with Bitget and law enforcement to trace the funds.

Scattered across four chains in three hours

According to Chainalysis, $387 million left Bitget across 23 transfers in the first three hours after the exploit. The funds landed on four blockchains in the following proportions.

• Ethereum: 49.7%
• XRP Ledger: 40.8%
• Zcash: 7.6%
• Tron: 1.8%

From there, the attackers moved the money through cross-chain liquidity and messaging protocols, instant swaps and laundering services. Hundreds of transfers followed the start of the attack, including funds moved from Ethereum to Bitcoin.

Stolen XRP was swapped into bitcoin, not sent to an exchange

The stolen XRP was the focus of much of Chainalysis' work. Rather than sending it to an exchange, the attackers pushed the XRP through a cross-chain liquidity protocol, which lets a user deposit one asset on one chain and receive a different asset on another, and took bitcoin out the other side. The swaps require no account or intermediary, but each one still leaves an on-chain record. Chainalysis said its investigators matched deposits to their corresponding payouts to bridge the gap between blockchains.

Tens of millions of dollars moved through this route over roughly a day and a half. Chainalysis said it followed the funds through several on-chain protocols to attacker-controlled bitcoin addresses that it is now monitoring. The company said it used in-house AI to build custom automation that compressed more than 20 hours of manual bridge reconciliation to under 10 minutes, adding that its investigators still defined the logic and reviewed the outputs. Labels flagging the stolen funds went live in its data platform as soon as they were identified, giving exchanges and law enforcement visibility.

Just over $800,000 frozen so far

Only a small share of the stolen funds has been locked. According to crypto news outlet Decrypt, stablecoin issuers Circle and Tether on Sept. 25, the day after the hack, blacklisted an Ethereum address linked to the attacker, freezing 99,990 USDC and 218,023 USDT, or about $318,000 combined. Circle acted first, and Tether followed roughly seven hours later. About 170 ETH in the same address was left untouched, because issuers can freeze only their own tokens and no one can freeze Ethereum itself. The attacker had rushed to convert freezable stablecoins into ETH, and other attacker addresses still hold more than 63,000 ETH, the outlet reported.

Cross-chain trading service NEAR Intents said it froze $503,000 of the hacker's funds, while about $166,000 passed through its swap system, DeFi outlet The Defiant reported. NEAR Intents also said it would not take the recovery bounty Bitget had offered (5% of frozen funds and 5% of recovered funds). Even combined, the frozen amounts come to less than 0.3% of the total loss.

From breach to North Korea attribution in under two weeks

1. Sept. 24Attackers breach the backend of Bitget's wallet system and make unauthorized transfers; $387 million leaves in 23 transfers within three hours
2. Sept. 25Bitget CEO Gracy Chen says at a town hall that IP addresses, behavioral patterns and on-chain signatures point to North Korea-linked hacker groups
3. Sept. 26Bitget says the vulnerability has been fixed and announces a phased withdrawal schedule; its protection fund covers the loss, with Mandiant and SlowMist supporting the investigation
4. Sept. 28 to Oct. 2Scheduled withdrawal restart in order: bitcoin, Ethereum, tether (USDT), then other tokens and fiat
5. Oct. 1Chainalysis publishes its North Korea attribution and tracing findings

At the town hall, Chen pointed to North Korea's $1.5 billion theft from Bybit in 2025, saying, "If Bybit can hold on [after] a $1.5 billion loss, we can definitely hold on to a $350 million+ loss," U.S. security outlet The Record reported. Bitget said user account balances were not affected. Chainalysis said it will spend the coming weeks labeling newly identified addresses and sharing intelligence with exchanges, issuers and law enforcement.

XRP, the native token of the XRP Ledger, one of the chains the stolen funds passed through, trades on South Korea's won market (KRW trading pairs on local exchanges). As of 3:30 p.m. KST on Oct. 4, XRP traded at 2,028 won on Upbit, ranking fifth by trading value on its won market. Zcash and Bitget's own token, BGB, are not listed on Upbit's or Bithumb's won markets.