Chainalysis Links $387M Bitget Hack to North Korea
Blockchain analytics firm Chainalysis has attributed the $387 million Bitget hack on 24 September to North Korea-linked actors. The attribution adds to earlier assessments from Bitget CEO Gracy Chen and Elliptic that the Democratic People’s Republic of Korea was likely responsible.
Chainalysis said the theft pushed crypto stolen by North Korea-linked groups in 2026 above $1 billion. Within three hours, the attackers moved the funds through 23 transfers across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%) and Tron (1.8%). They then used cross-chain liquidity and messaging protocols, instant swaps and laundering services to conceal the trail.
The attackers converted tens of millions of dollars in XRP into Bitcoin through a cross-chain liquidity protocol. Some funds were also moved into Zcash’s shielded pool and later transferred to attacker-controlled Bitcoin addresses.
Chainalysis said its in-house artificial intelligence tools reduced more than 20 hours of manual bridge reconciliation to under 10 minutes. However, the firm stressed that investigators remained responsible for directing the analysis.
The Bitget hack has triggered wider scrutiny of crypto infrastructure. Near Intents rejected more than $50 million in related swaps, while THORChain continued processing transactions. Circle and Tether froze about $318,000 in stablecoins. For traders, the case highlights continued North Korea-linked hacking risks, cross-chain laundering activity and the potential for rapid freezes or heightened compliance checks.
Bearish
The immediate market impact is bearish because the Bitget hack highlights ongoing exchange-security and North Korea-linked theft risks. Large stolen balances moving across Ethereum, XRP, Zcash, Tron and Bitcoin can create temporary selling pressure, especially if the attackers liquidate assets through decentralized or cross-chain venues.
The event may also increase volatility in the affected tokens and raise the risk of transaction censorship, wallet blacklisting and stricter compliance checks. Traders may react by reducing exposure to smaller exchanges, cross-chain protocols and assets directly connected to the laundering trail. Similar exchange hacks and major cybercrime disclosures have historically produced short-term risk aversion, wider spreads and pressure on affected platforms or tokens.
The bearish effect is likely to be contained rather than systemic. Chainalysis’ rapid tracing, the freezing of some stablecoins and monitoring of attacker-controlled Bitcoin addresses limit the amount of funds that can be sold immediately. The incident does not indicate a protocol-wide failure across the broader crypto market.
Over the longer term, improved blockchain intelligence and AI-assisted investigations could support market confidence by increasing recovery and enforcement capabilities. However, recurring North Korea-linked thefts may lead to higher security costs, tougher exchange controls and a persistent risk premium for crypto assets. Traders should watch for confirmed fund liquidations, additional freezes, exchange disclosures and volatility in BTC, ETH, XRP, ZEC and TRX.