Blockchain analytics firm Chainalysis has formally attributed the $387 million Bitget exchange exploit to North Korean hackers, pushing total cryptocurrency stolen by DPRK-linked actors in 2026 past the $1 billion mark.
Automated Tracing Exposes Cross-Chain XRP Swaps
Following the September 24 breach, Chainalysis identified 23 outbound transfers within the first 3 hours that distributed $387 million across four networks. Ethereum absorbed 49.7% of the stolen funds, while the XRP Ledger received 40.8%. The privacy coin network Zcash accounted for 7.6%, and Tron handled the remaining 1.8%.
Rather than moving funds to centralized exchanges, the attackers routed the stolen XRP into a cross-chain liquidity protocol, converting the tokens into Bitcoin across a secondary network. Tens of millions of dollars moved through this mechanism over approximately 36 hours, ending at attacker-controlled Bitcoin addresses.
Chainalysis noted that its custom AI automations reduced manual cross-chain bridge reconciliation time from more than 20 hours to under 10 minutes, with human investigators overseeing the logic and results. "The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds," Chainalysis stated.
DPRK Crypto Thefts Exceed $1 Billion in 2026
Bitget CEO Gracy Chen previously pointed toward North Korean involvement shortly after the incident, citing IP addresses that matched known DPRK VPN infrastructure. The $387 million theft ranks as 2026's largest crypto attack, driving total September industry hack losses up by 462%.
The attack follows two massive April exploits also tied to North Korean threat actors. On April 1, hackers stole $285 million from Drift Protocol using months of social engineering and in-person meetings. On April 18, attackers took $292 million in a KelpDAO bridge exploit, which TRM and LayerZero linked to the Lazarus-affiliated group TraderTraitor. According to TRM, those two April attacks alone accounted for 76% of all crypto exploit losses through April. While North Korea's 2026 loot has now crossed $1 billion, DPRK actors stole more than $2 billion from the industry in 2025.
Key Takeaways
- Chainalysis confirmed North Korea stole $387 million from Bitget on September 24.
- Total crypto stolen by DPRK-linked actors in 2026 now exceeds $1 billion, following $2 billion+ in 2025.
- Attackers swapped XRP directly for Bitcoin via cross-chain protocols without touching centralized exchanges.
- Ethereum (49.7%) and XRP Ledger (40.8%) received the majority of the initial funds.
Why It Matters
North Korea's pivot toward non-custodial cross-chain liquidity protocols highlights an evolving strategy designed to bypass centralized exchange freezes and compliance blocks. By avoiding traditional order books and automating token swaps across networks, cybercriminals are forcing security teams to adapt rapidly. The deployment of AI-driven tracing by intelligence firms demonstrates that combating state-sponsored hacking now requires automated, real-time forensic capabilities to monitor cross-chain money laundering.
