Chainalysis Ties $387M Bitget Hack to North Korea, Pushing 2026 Crypto Theft Past $1 Billion

Published October 14, 2026, 13:45 UTC. Based on Chainalysis's October 1, 2026 report "How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget", with secondary reporting from Startup Fortune (October 13, 2026) and Asia Daily, and Bitget's September statements.

Blockchain analytics firm Chainalysis has formally attributed the $387 million September 24 theft from crypto exchange Bitget to actors linked to North Korea, a finding that pushes the regime's confirmed crypto haul for 2026 past $1 billion. The firm detailed its conclusions in a report published October 1, describing how the funds were drained from Bitget's hot wallets and moved across four blockchains within three hours, with investigators then following the laundered assets through bridges, cross-chain liquidity protocols, mixers and decentralized exchanges.

23 transfers in three hours: how the $387 million left Bitget

Bitget's security systems flagged unauthorized transfers moving out of the exchange's hot wallets at 18:31 UTC on September 24, according to Startup Fortune. Within three hours, attackers moved the funds across 23 separate transfers that landed on four networks: Ethereum took 49.7% of the outflows, XRP took 40.8%, Zcash held 7.6% and Tron took the remaining 1.8%, according to Chainalysis's breakdown. The movement stood out for its speed. Rather than funneling stolen XRP toward a centralized exchange where it might be frozen, the attackers ran it through a cross-chain liquidity protocol and withdrew bitcoin on the other side, a step Chainalysis said lines up with known North Korean cash-out playbooks. Tens of millions of dollars moved through that route over roughly 36 hours before reaching bitcoin addresses that investigators have placed under surveillance, the firm said.

The $35.9 million recount: $351.6 million became $387.5 million

Bitget first put the damage at $351.6 million. On September 25 the exchange raised its estimate to $387.5 million after identifying additional stolen assets, including transfers involving Zcash and Tron it had initially missed, according to Asia Daily. The $35.9 million increase reflected additional accounting, not a second attack, the exchange said. At the revised figure, the breach is the largest crypto exchange hack of 2026, according to Startup Fortune. Estimates vary slightly by investigator because of different tracking scopes: Bitquery traced $386.80 million through 23 transfers across nine chains, while Chainalysis described the initial distribution across the four main networks, Asia Daily reported.

No stolen keys: the attackers spoofed the approval system

What separates this breach from many exchange hacks is what the attackers did not touch. Bitget said the intrusion did not compromise its cold wallet keys and did not depend on fabricated customer withdrawal requests. Instead, the attackers compromised a backend system inside Bitget's wallet infrastructure and supplied forged transaction authorization data, tricking the exchange's own signing service into approving payouts that looked routine. Bitget described the entry point as a zero-day vulnerability in a third-party security tool it relied on, not a flaw its own engineers wrote, according to Startup Fortune. Preliminary forensic work attributed to Mandiant and SlowMist placed the earliest logged malicious activity on August 31, more than three weeks before the theft, and SlowMist reportedly recovered a deleted tool tailored to Bitget's withdrawal system that forged risk-control fields and invoked the withdrawal process, Asia Daily reported. The vendors have not been publicly named.

What supports the North Korea attribution

Bitget chief executive Gracy Chen pointed to IP address behavior and on-chain transaction signatures almost immediately, telling reporters the attack was "consistent with techniques used by DPRK-linked hacker groups", according to Startup Fortune. Chainalysis then independently attributed the theft to North Korean actors in its October 1 findings, while Elliptic assessed the connection as highly likely, citing links to laundering addresses associated with earlier thefts including Bybit, and TRM Labs also assessed a North Korean connection as likely, Asia Daily reported. The assessments are not the same as a public criminal finding: investigators have not publicly established that a particular Lazarus subgroup carried out the Bitget intrusion, and the annual figures need care. Chainalysis says the Bitget theft brings the regime's 2026 tally to at least $1.0305 billion, on top of $643 million attributed to North Korean-linked actors in the first half, according to Asia Daily. Most of that early haul came from two April attacks: Drift Protocol lost $285 million in a 12-minute social engineering attack on April 1, and KelpDAO lost $292 million to a LayerZero bridge exploit on April 18 that researchers attributed to TraderTraitor, a Lazarus subgroup specializing in cross-chain infrastructure, according to Startup Fortune.

How AI cut 20 hours of tracing into ten minutes

The investigation's distinctive feature was speed. Matching stolen XRP deposited into a cross-chain protocol with bitcoin paid out elsewhere normally requires an analyst to reconcile bridge transactions pair by pair, work Chainalysis estimated at more than 20 hours for this incident. The firm said custom automation built with its internal AI compressed that reconciliation task into under 10 minutes, with human investigators directing the work and reviewing results. The AI did not solve the theft or recover the money, Asia Daily noted, and parts of the trail were harder to follow: the attackers began moving funds into Zcash's shielded pool, where privacy features conceal transaction details, and Chainalysis said it would continue monitoring destination addresses with exchanges and law enforcement. Chainalysis said it worked with Bitget and law enforcement to trace the assets and flagged attacker addresses to exchanges, law enforcement and compliance teams.

The recovery so far: a $300 million backstop and split reactions

Bitget pledged on September 28 to restore its User Protection Fund to at least $300 million within a week, and said on September 30 it had already done so, two days ahead of its own deadline. The fund held more than $464 million before the hack, so the loss was equal to roughly 84% of it, according to Finance Magnates figures cited by Startup Fortune. Bitget reopened bitcoin, ether and USDT withdrawals in stages once the vulnerability was patched and started a bounty program paying tipsters 5% of any recovered funds, with some stolen assets already frozen. Responses to the stolen funds have split across the industry. NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers tied to the breach and froze about $503,000 during execution, while THORChain kept processing swaps and rejected Bitget's request for selective intervention, Asia Daily reported. Circle and Tether froze about $318,000 in stablecoins linked to the incident, while separate Justice Department actions targeted $7.7 million tied to alleged North Korean IT worker fraud and more than $15 million linked to four thefts attributed to APT38, according to Asia Daily.

This article is news reporting and is not investment advice.

Sources

• Chainalysis, "How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget", October 1, 2026, primary source for the attribution, the 23-transfer three-hour distribution across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%) and Tron (1.8%), the XRP-to-bitcoin laundering route, and the AI-accelerated tracing
• Bitget, company statements reported September 24 to 30, primary source for the $351.6 million initial estimate and $387.5 million revision, the zero-day in a third-party security tool, the 18:31 UTC detection time, the staged withdrawal reopening, the User Protection Fund restoration to at least $300 million by September 30, and the 5% recovery bounty
• Bitget CEO Gracy Chen, via Startup Fortune, secondary source for the "consistent with techniques used by DPRK-linked hacker groups" assessment based on IP behavior and on-chain signatures
• Startup Fortune, October 13, 2026, secondary source for the $643 million first-half North Korean-linked tally, the Drift Protocol $285 million and KelpDAO $292 million April attacks, the TraderTraitor attribution, the $464 million pre-hack fund size, and the UN's 2024 estimate of more than $3 billion stolen since 2017
• Asia Daily, secondary source for the at-least $1.0305 billion 2026 tally, the $35.9 million revision accounting, the August 31 earliest malicious activity and Mandiant and SlowMist forensic details, the Elliptic and TRM Labs attribution assessments, the NEAR Intents and THORChain responses, the $318,000 stablecoin freezes, and the DOJ's $7.7 million IT-worker and $15 million APT38 actions