Attackers extracted $387 million from cryptocurrency exchange Bitget on September 24, 2026, and on-chain analytics firm Chainalysis has now attributed the theft to operatives linked to North Korea. The attribution follows the conversion of the stolen XRP into Bitcoin, based on the firm's on-chain tracking of the stolen assets. Because transfers on public blockchains leave permanent, publicly viewable records, funds taken in an exploit can often be followed from the point of theft even as they are exchanged between different assets.

With this incident included, the value of cryptocurrency taken by DPRK-linked actors in 2026 has surpassed $1 billion, according to Chainalysis. The finding follows 2025, a year in which North Korean actors were likewise tied to major crypto thefts — most prominently the February 2025 breach of exchange Bybit, in which roughly $1.46 billion was drained and which Chainalysis and other researchers attributed to the Lazarus Group, a hacking unit linked to Pyongyang. The Bybit breach stands among the largest cryptocurrency thefts on record, and both it and the Bitget incident involved centralized exchanges, which hold large pools of customer assets and have featured repeatedly in the sector's most damaging losses.

North Korea-linked groups have ranked for years among the most prolific perpetrators of cryptocurrency theft. United Nations experts have previously assessed that proceeds from such operations help fund the country's state programs, including weapons development, though the end use of any specific set of stolen funds is typically not confirmed when an incident is first reported.

Converting stolen tokens into Bitcoin has been a recurring pattern in earlier North Korea-linked cases documented by blockchain analysts, a step generally associated with efforts to obscure the origin of funds ahead of further laundering. Because the same public records remain visible after such swaps, analysts can continue tracing the funds as they move through additional wallets or services in later stages.

Bitget is a global cryptocurrency exchange particularly active in derivatives trading. Chainalysis, a blockchain data and analytics firm, regularly publishes attributions of large-scale crypto thefts based on the movement of funds across public blockchains.

This content was first published on COINOTAG: https://en.coinotag.com/chainalysis-387m-bitget-theft-xrp-north-korea