Bitget Targeted by North Korean Hacker Group in Major Crypto Theft

North Korea did it again. Blockchain analytics firm Chainalysis has tied the $387 million hack on crypto exchange Bitget directly to North Korean-linked hacking groups — and the theft is now a major chunk of the over $1 billion in crypto stolen by those same groups so far in 2026.

The significant hack on Bitget underscores the ongoing vulnerabilities within centralized cryptocurrency exchanges, particularly as North Korean hacking groups continue to exploit these weaknesses for large-scale thefts. This incident not only highlights the urgent need for enhanced security measures in the crypto sector but also raises concerns about the potential for increased regulatory scrutiny on exchanges, which could impact market operations and investor confidence. As such, the theft contributes to the broader narrative of cybersecurity risks that plague the cryptocurrency ecosystem, potentially influencing user behavior and market dynamics moving forward.

The breach hit on September 24. Within the first three hours, $387 million moved out of Bitget in 23 separate transactions, spread across four networks: Ethereum took the biggest slice at 49.7%, XRP followed at 40.8%, Zcash got 7.6%, and Tron picked up the remaining 1.8%. Fast, clean, and clearly planned well in advance.

Chainalysis has since been working alongside Bitget and law enforcement to trace the funds as they moved through a maze of blockchains, swap services, and liquidity protocols. The stolen XRP didn’t just sit there. It got routed through a cross-chain liquidity protocol, converted into Bitcoin, and pushed into addresses the attackers control. The broader laundering operation leaned on cross-chain liquidity and messaging protocols, instant swaps, and dedicated laundering services — a layered approach designed to make tracing a nightmare. And it kind of worked, at least for a while.

Chainalysis didn’t just rely on human analysts. The firm used its own in-house AI technology to speed up the investigation, compressing what would’ve been over 20 hours of manual reconciliation into under 10 minutes. That’s a pretty significant jump. Human oversight stayed in the loop throughout — the AI didn’t run solo — but the speed difference is hard to ignore when you’re chasing funds moving across multiple chains in real time.

Other firms backed up the North Korea angle. Bitget CEO Gracy Chen and blockchain analytics company Elliptic both flagged patterns consistent with North Korean hacker activity, adding weight to Chainalysis’s assessment. No one seems to be disputing the attribution at this point.

Not every platform handled the situation the same way. Near Intents moved fast, blocking over $50 million in swaps linked to the hacker. Then, somewhat ironically, Near Intents itself got hit by a hack. Thor