$387 million stolen from Bitget traced to North Korea-linked actors across four chains
Chainalysis traced $387 million stolen from Bitget in 23 transfers across four chains and attributed the September 24 breach to North Korea-linked actors.
Why it matters
On Chainalysis's accounting the Bitget theft is what carries North Korea-linked crypto theft in 2026 past $1 billion, and the four-way split across Ethereum, XRP, Zcash and Tron means any freeze has to be coordinated across four networks at once. Chainalysis says automated cross-chain matching narrows the window for exchanges, issuers and law enforcement to act on traced funds, and Bitget is offering 5% rewards for information that leads to a freeze.
Where the sources disagree
Publication date of the Chainalysis report
Oct. 1, 2026
Crypto.News
Wednesday
Decrypt
Crypto.News dates the Chainalysis report to Oct. 1 while Decrypt, published Oct. 3, describes the report as published on Wednesday.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (bitget hack)
$387 million
Crypto News (CryptoNews.net)
$351.6 million
CoinGape
Crypto News (CryptoNews.net) reports $387 million, CoinGape reports $351.6 million (9% apart).
amount taken (bitget)
$351.6 million
CoinGape
$387 million
Crypto.News
CoinGape reports $351.6 million, Crypto.News reports $387 million (9% apart).
amount taken
$351.6 million
CoinGape
$387 million
Bitcoin Insider
CoinGape reports $351.6 million, Bitcoin Insider reports $387 million (9% apart).
amount taken (bitget hack)
$351.6 million
CoinGape
$387 million
Decrypt
CoinGape reports $351.6 million, Decrypt reports $387 million (9% apart).
Key facts
Chainalysis attributed the $387 million Bitget hack to DPRK-linked actors.
387,000,000 USDDisputed figureReported by Crypto News (CryptoNews.net)
The funds left Bitget in 23 transfers during the first three hours after the breach.
23 transfersReported by Crypto News (CryptoNews.net)
The 23 transfers reached four networks: Ethereum 49.7%, XRP 40.8%, Zcash 7.6% and Tron 1.8%.
49.7 %Reported by Crypto News (CryptoNews.net)
CoinGape reports the loss was initially assessed at $351.6 million before a fuller accounting revised it to $387.5 million.
351,600,000 USDDisputed figureReported by CoinGape
Bitget detected unauthorized transfers from its hot and warm wallets at 18:31 UTC on September 24, 2026, with cold wallets untouched.
Disputed figureReported by CoinGape
Chainalysis said the Bitget theft pushes crypto stolen by North Korea-linked groups in 2026 past $1 billion.
1,000,000,000 USDDisputed figureReported by CoinGape
Bitget has offered separate 5% rewards for qualifying help in freezing and recovering the stolen funds.
5 %Reported by Crypto.News
What happened
Bitget detected unauthorized transfers from its hot and warm wallets at 18:31 UTC on September 24, 2026; its cold wallets were untouched, and CEO Gracy Chen said the attacker compromised a critical backend system, spoofed transaction data and triggered the authorization process (CoinGape). The loss was first put at $351.6 million and later revised to $387.5 million, while Crypto News, Crypto.News, Bitcoin Insider and Decrypt report $387 million (CoinGape, Decrypt, Crypto News, Crypto.News, Bitcoin Insider). Chainalysis reported on Oct. 1 that the money left in 23 transfers within three hours and reached four networks, with Ethereum taking 49.7%, XRP 40.8%, Zcash 7.6% and Tron 1.8% (Crypto News, CoinGape, Decrypt). The firm attributed the breach to DPRK-linked actors, which Decrypt places alongside earlier DPRK assessments from Bitget's CEO and Elliptic, and said the theft pushes North Korea-linked crypto theft in 2026 past $1 billion (CoinGape, Crypto.News, Bitcoin Insider, Decrypt). Chainalysis also said its in-house AI cut more than 20 hours of manual bridge reconciliation to under 10 minutes, with investigators setting the matching rules and checking results (Crypto News, CoinGape, Crypto.News, Bitcoin Insider, Decrypt), and Crypto.News reports that tracked stolen XRP reached Bitcoin addresses the attackers controlled through cross-chain swaps. Bitget has offered separate 5% rewards for help that qualifies for freezing or recovering the stolen funds (Crypto.News); no recovered amount has been reported.
How the story developed
- Update
Bitget detects unauthorized transfers from hot and warm wallets
Detection at 18:31 UTC on September 24, 2026; cold wallets were left untouched.
- Correction
Bitget loss estimate revised upward
The figure moved from $351.6 million to $387.5 million after a fuller accounting, according to CoinGape.
- Official statement
Chainalysis attributes the hack to DPRK-linked actors
The firm's report put the theft at $387 million across 23 transfers and four chains, said it pushed North Korea's 2026 total past $1 billion, and described AI-assisted tracing that cut 20-plus hours of bridge reconciliation to under 10 minutes.
- First report
First report by Crypto News (CryptoNews.net)
Chainalysis Links $387M Bitget Hack to DPRK-Linked Actors After 23 Transfers
- Independent corroboration
Independently corroborated by CoinGape
Chainalysis AI Compresses $387M Bitget Trace From 20 Hours of Bridge Work to Under 10 Minutes
- Official statement
Gracy Chen describes a backend compromise and spoofed transaction data
The Bitget CEO said the attacker compromised a critical backend system and triggered the authorization process.
- Official statement
Bitget offers 5% rewards for help freezing or recovering funds
The reward applies to information that qualifies under the exchange's program.
- Update
Decrypt publishes the fullest account of the laundering chain
Decrypt reported the cross-chain swaps, instant swaps and laundering services used after the funds reached the four networks, and cited earlier DPRK assessments from Bitget's CEO and Elliptic.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 2 Oct 2026, 18:54 UTC: Crypto News (CryptoNews.net) — 1 independent source, 1 reports
- 3 Oct 2026, 08:08 UTC: CoinGape — 2 independent sources, 2 reports
- 3 Oct 2026, 12:00 UTC: Crypto.News — 3 independent sources, 3 reports
- 3 Oct 2026, 14:03 UTC: Bitcoin Insider — 4 independent sources, 4 reports
- 3 Oct 2026, 17:01 UTC: Decrypt — 5 independent sources, 5 reports
Affected entities
Also mentioned: Tether USDt, Circle, Chainlink
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Crypto News (CryptoNews.net) Aggregator | Chainalysis Links $387M Bitget Hack to DPRK-Linked Actors After 23 Transfers | Original | |
| Decrypt Crypto media | Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea | Independent | |
| Crypto.News Crypto media | Chainalysis AI traces $387M Bitget hack in under 10 minutes | Independent | |
| CoinGape Crypto media | Chainalysis AI Compresses $387M Bitget Trace From 20 Hours of Bridge Work to Under 10 Minutes | Independent | |
| Bitcoin Insider Aggregator | Chainalysis AI Cuts $387M Bitget Hack Trace From 20 Hours to Under 10 Minutes | Syndicated |
Related events
Chainalysis says state-linked hackers drove 420% surge in malware instructions stored on public blockchains
Chainalysis found state-linked hackers used public blockchains to store malware instructions, with cases rising 420% over 12 months.
US Treasury sanctions seven TRON addresses over alleged Tren de Aragua ATM scheme
OFAC added seven TRON addresses holding about $6.1 million to its sanctions list on September 30, alongside eight people and two Mexico-based companies in a Tren de Aragua ATM jackpotting case.
Chainalysis says a task-scam operator lost 60 BTC to the tampered Ledger drain
A task-scam operator lost 60 BTC, about $4.8 million, when thieves emptied three tampered Ledger addresses into one wallet, Chainalysis says.
Drift Protocol exploiter moves 44,510 ETH to Tornado Cash over two days after six-month dormancy
Wallets linked to the April Drift exploit sent 44,510 ETH worth $109 million to Tornado Cash on October 20-21, retaining approximately 56,569 ETH.
UK sanctions Cryptomus, Heleket and TokenSpot in 38-designation Russia package
The UK sanctioned three crypto platforms and two payment firms on October 8 for allegedly helping Russia evade financial sanctions, linking them to the Kremlin-backed A7 network and sanctioned exchanges Garantex and Grinex.