Chainalysis Links $387 Million Bitget Hack to DPRK-Linked Actors
Chainalysis has attributed the $387 million hack of crypto exchange Bitget to threat actors linked to North Korea, according to information shared by Wu Blockchain.
The blockchain analytics firm said investigators tracked the stolen assets across multiple networks shortly after the attack. Within the first three hours, the funds moved through Ethereum, XRP, Zcash and Tron in 23 separate transfers.
Stolen Funds Moved Across Four Blockchains
Ethereum and XRP accounted for the largest portions of the transfers tracked during the initial three-hour period, representing 49.7% and 40.8% of the stolen funds, respectively.
The movement across several blockchain networks complicates efforts to follow and recover assets following a major cryptocurrency theft. In this case, Chainalysis continued tracing the stolen funds after they moved beyond their initial networks.
The investigation identified activity involving cross-chain liquidity protocols, through which tens of millions of dollars worth of stolen XRP were moved into Bitcoin over roughly a day and a half.
The cross-chain movement indicates that the funds did not remain concentrated on a single blockchain following the attack. Instead, investigators tracked transactions as the assets were transferred between different networks and converted into other forms of cryptocurrency.
DPRK-Linked Crypto Theft Surpasses $1 Billion in 2026
Chainalysis' attribution places the Bitget incident within a broader series of cryptocurrency thefts associated with DPRK-linked actors.
According to the information shared by Wu Blockchain, the Bitget hack has pushed the total value of crypto thefts linked to DPRK actors in 2026 above $1 billion.
The figure covers thefts attributed to DPRK-linked activity during the year and places the Bitget incident among the largest such attacks tracked during the period.
The attribution comes from blockchain investigation rather than a conventional criminal case. Chainalysis' analysis focuses on transaction flows and the movement of stolen assets across public blockchain networks, allowing investigators to follow funds even after they are transferred between different chains.
Cross-Chain Movement Remains Part of the Investigation
The movement of tens of millions of dollars in stolen XRP into Bitcoin over approximately 36 hours provides another stage in the tracking of the stolen funds.
Chainalysis' tracing shows how assets involved in a single hack can move through several blockchain ecosystems and cross-chain liquidity infrastructure in a relatively short period. The investigation cited by Wu Blockchain covered Ethereum, XRP, Zcash and Tron during the initial movement of funds before tracing additional activity involving Bitcoin.
The Bitget hack therefore remains tied to an ongoing on-chain investigation into where the stolen assets have moved and how they were transferred across networks.
Writer: Victoria HaleTechnology & Blockchain WriterVictoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.She prioritises clarity and accuracy when explaining technical developments to a general audience.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.