Chainalysis links $387 million Bitget hack to North Korea

A major security breach on September 24, 2026, drains approximately $387.5 million from cryptocurrency exchange Bitget. Attackers bypass private keys by compromising a backend wallet system to spoof transaction data. Blockchain analytics firms, including Chainalysis, attribute the heist to North Korean state-linked hackers, pushing the group's suspected 2026 thefts past $1 billion. While Bitget pledges to fully cover losses using its $464 million User Protection Fund, only 0.2% of the stolen assets have been frozen.

Attribution to North Korean hackers

• ▪Blockchain analytics firms Chainalysis, TRM Labs, and Elliptic attributed the September 24, 2026 $387.5 million Bitget hack to North Korean state-linked cyber actors
• ▪Bitget CEO Gracy Chen linked the September 24, 2026 Bitget hack to North Korean groups based on matching IP addresses and on-chain activity patterns
• ▪The September 24, 2026 $387.5 million Bitget heist pushed the total estimated cryptocurrency stolen by suspected North Korean hackers in 2026 past $1 billion

Chainalysis tracing with artificial intelligence

• ▪Chainalysis's in-house artificial intelligence tools reduced the time required for manual cross-chain bridge reconciliation of funds stolen in the September 24, 2026 Bitget hack from over 20 hours to under 10 minutes
• ▪Chainalysis used in-house artificial intelligence and automation tools to trace the stolen Bitget funds across multiple blockchains following the September 24, 2026 Bitget hack

Scope of the breach

• ▪The Bitget security breach on September 24, 2026, which is the largest reported cryptocurrency exchange hack of 2026, initially estimated losses at $351.6 million before revising the figure to $387.5 million
• ▪Bitget's cold wallets remained secure during the September 24, 2026 Bitget security breach

Method of the security breach

• ▪The attackers behind the Bitget hack bypassed Bitget's private keys entirely, instead manipulating the backend authorization checks to approve unauthorized withdrawals during the September 24, 2026 hack
• ▪On September 24, 2026, attackers compromised Bitget's backend wallet system to spoof transaction data and steal approximately $387.5 million

Theft and laundering of XRP

• ▪Attackers laundered the XRP stolen in the September 24, 2026 Bitget hack by routing it through cross-chain liquidity protocols like THORChain to convert the assets into Bitcoin
• ▪Approximately 103 million XRP, valued at roughly $157 million, was stolen from Bitget on September 24, 2026, representing the single largest asset class targeted in the Bitget hack

Debatable claims

• ▪On-chain activity and IP addresses are sufficient to attribute cyberattacks to state actors
• ▪The cryptocurrency industry bears primary responsibility for funding North Korean cyber warfare
• ▪Cross-chain liquidity protocols should be legally required to block illicit transactions