Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH 
TRX 
XRP 
ZEC Chainalysis blames North Korean hackers for the $387 million theft of Bitget
Blockchain analysis company Chainalysis has blamed North Korea for a $387 million hacking attack on its Bitget exchange last month, further confirming the growing consensus that Pyongyang's hacker groups are behind the largest cryptocurrency theft this year.
Chainalysis pointed out in a report released Wednesday that the September 24 invasion was linked to actors linked to the Democratic People's Republic of Korea (DPRK). The theft brought the total value of cryptocurrencies stolen by North Korean-related groups to exceed the US$1 billion mark in 2026.
The company said it has been working with Bitget and law enforcement since the attack to track the flow of funds on multiple blockchains.
Rapid Fund Transfer Path
Chainalysis details the speed of funds transfer. In the first three hours,$387 million flowed out of Bitget through 23 transfers and spread across four networks: Ethereum received nearly half, accounting for 49.7%; followed by XRP, accounting for 40.8%;Zcash, 7.6%; and Tron, 1.8%.
The attackers then used cross-chain liquidity protocols, messaging protocols, instant redemption services, and money laundering services to cover up the traces of funds.
The theft of XRP attracts special attention
The stolen XRP attracted special attention. Rather than routing it directly to the exchange, the attacker processes it through a cross-chain liquidity protocol and extracts Bitcoin on the other end. Tens of millions of dollars flowed in the process, which took about a day and a half before eventually reaching a Bitcoin address controlled by the attacker who is currently being monitored.
AI technology accelerates the investigation process
It is worth noting that Chainalysis said it relies on internal artificial intelligence technology to maintain investigation efficiency and has built customized automated tools to compress the manual bridging reconciliation work that was originally estimated to take more than 20 hours to less than 10 minutes to complete.
The company emphasized that the technology is designed to speed up the work of investigators, not replace them, and that humans still dominate the entire investigation process.
Multi-party assessments point to North Korea
This attribution judgment echoes earlier assessment results. Bitget CEO Gracy Chen pointed out that the attack pattern is consistent with the characteristics of North Korean hackers, while Elliptic, another blockchain analysis company, also believes that links to North Korea are "highly likely."
The Open Fund Laundering Game
Hackers 'cryptocurrency laundering activities have been carried out in the public eye, with keen investigators tracking every trend. The attackers initially tried to hide the funds in Zcash's protected pool. At the same time, the reactions of redemption services were mixed: Near Intentions rejected more than $50 million in redemption requests related to the hacker, but was itself hacked a few days later; Thorchain continued to process the transactions.
In addition, Circle and Tether froze approximately $318,000 in stablecoin assets.
