Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH 
TRX 
XRP 
ZEC Chainalysis: North Korean hackers stole US$387 million from Bitget, and the total amount of encryption theft by North Korean affiliated organizations exceeded US$1 billion in 2026.
Blockchain intelligence company Chainalysis pointed out in a report released on October 1 that North Korean actors launched an attack on the hot wallet of the Bitget exchange and stole US$387 million worth of cryptocurrency. By tracking stolen funds on four blockchains, Chainalysis confirmed that the total value of cryptocurrencies stolen by North Korea-related groups in 2026 has exceeded the US$1 billion mark.
After the accident, Bitget suspended the coin withdrawal service and gradually restored various functions since late September. The findings provide the most detailed public record to date of how funds flowed from the exchange on September 24.
Analysis of the flow of stolen funds
According to Chainalysis, within three hours after the vulnerability was exploited, a total of 23 transfers transferred US$387 million out of Bitget and dispersed across four different blockchain networks. Among them, Ethereum received 49.7% of the funds, XRP received 40.8%, Zcash received 7.6%, and Tron received 1.8%.
It is worth noting that the attacker did not directly transfer the stolen XRP to a centralized exchange, but instead transferred tens of millions of dollars in funds through a cross-chain liquidity protocol and extracted Bitcoin at the other end. Chainalysis took about a day and a half to reconstruct this money-laundering path by matching deposits with their corresponding payments.
该公司表示，在最初的资金外逃之后，又发生了数百笔转账交易。资金在以太坊和比特币等网络之间反复穿梭，利用了桥接服务、混币器和去中心化交易所等多种工具进行清洗。调查人员利用超过十年积累的跨链归因数据，成功在不同协议之间匹配了存款和付款记录。
人工智能辅助追踪技术
Chainalysis指出，调查人员在其智能体平台上构建了自定义自动化工具，以查询其内部数据并加速复杂的跨链追踪工作。在一次实例中，该工具将原本需要超过20小时的手工桥接对账时间压缩至不到10分钟。
该公司强调，这些工具并未取代人类的判断力：调查人员仍需定义逻辑、审查输出结果并指导整个调查方向。在一个全天候运作的指挥中心内，Bitget及其执法合作伙伴保持着实时同步。Chainalysis表示，在识别出被盗资金后的几分钟内，用于标记这些资产的标签便已在其实时数据平台上线，供合规团队和执法部门使用。
朝鲜关联盗窃创纪录的一年
根据Chainalysis的数据，此次归因认定使得2026年与朝鲜相关的行为体所窃取的加密货币总额超过10亿美元。Bitget已于9月下旬确认热钱包遭入侵事件，随后开始分阶段恢复提币服务。
Chainalysis said it will continue to monitor stolen funds, flag newly discovered addresses, and collaborate with exchanges, issuers and law enforcement partners. As tracking leads stretch in the coming weeks, this intelligence will support identifying, freezing or blocking stolen assets.
