Chainalysis attributes 387 million dollar Bitget crypto hack to North Korea
Blockchain firm Chainalysis linked a 387 million dollar Bitget exchange heist to North Korean hackers, pushing Pyongyang's stolen cryptocurrency total for 2026 past 1 billion dollars.
FTMQ News, written by our newsroom

Blockchain analytics firm Chainalysis has attributed a 387 million dollar cryptocurrency theft from the Bitget exchange to hackers linked to North Korea, Decrypt and BeInCrypto both report. Decrypt reported that the cyberattack occurred on September 24. According to both Decrypt and BeInCrypto, this heist pushed the total value of cryptocurrency stolen by actors linked to North Korea in 2026 past 1 billion dollars. [1][6]
Chainalysis used in-house artificial intelligence software to trace the stolen assets across four separate blockchains, Decrypt reported. Crypto News reported that the artificial intelligence system traced the funds in under 10 minutes, while CryptoRank reported that investigators tracked 23 separate transfers before linking the breach to actors tied to the Democratic People's Republic of Korea. [1][10][12]
BeInCrypto reported that the attackers executed a cross-chain swap to convert stolen XRP tokens into Bitcoin. Decrypt reported that Chainalysis collaborated with Bitget and law enforcement authorities to follow the stolen funds. Bitget is a cryptocurrency exchange that was established in 2018. Decrypt noted that Chainalysis published its findings on Wednesday, confirming that Pyongyang hackers executed one of the largest cryptocurrency thefts of the year. [1][6][14]
In short
- Chainalysis traced the 387 million dollar Bitget exchange hack to North Korea-linked actors.
- The theft pushed North Korea's total stolen cryptocurrency in 2026 over 1 billion dollars.
- Attackers converted stolen XRP tokens into Bitcoin using a cross-chain swap.
- Bitget is a cryptocurrency exchange that was founded in 2018.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Chainalysis Used AI to Trace the $387M Bitget Hack Back to North KoreaDecrypt, 1h ago (the report this story comes from)
- [2]North Korea says it test-fired an intermediate-range missile as tensions grow over mine blastsAP News, 6h ago
- [3]North Korea fires ballistic missile after Seoul demands apologySky News, 12h ago
- [4]North Korea launches ballistic missile after Seoul demands apology over wounded soldiersThe Guardian, 13h ago
- [5]North Korea launches ballistic missile as tensions with Seoul grow over border mine blastsFrance 24, 16h ago
- [6]Bitget Hack Update: XRP, Bitcoin, and North Korean LinkBeInCrypto, 5h ago
- [7]How ‘Unmasking a Monster: Aileen Wuornos’ Used AI to Bring a Serial Killer Back to LifeRolling Stone, 3h ago
- [8]Chainalysis Used AI to Trace the $387M Bitget Hack Back to North KoreaDecrypt News, 1h ago
- [9]Chainalysis Used AI to Trace the $387M Bitget Hack Back to North KoreaYahoo, 1h ago
- [10]Chainalysis AI traces $387M Bitget hack in under 10 minutesCrypto News, 6h ago
- [11]Bitget $387M Hack AI Tracing Speeds Blockchain ForensicsThe Cryptonomist, 6h ago
- [12]Chainalysis Links $387M Bitget Hack to DPRK-Linked Actors After 23 TransfersCryptoRank, 20h ago
Background
- [13]Pig butchering scam on Wikipedia
- [14]Bitget on Wikipedia
Our newsroom writes these reports with the help of software, from the 14 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ News
Earlier reports of ours on the same people and subjects.
- Chainalysis Attributes 387 Million Dollar Bitget Theft to North KoreaCrypto & Bitcoin, 2h ago
More in Crypto & Bitcoin
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.

Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.