Chainalysis has linked most of the XRP stolen in Bitget's $387.5 million exchange breach to North Korean state actors, the analytics firm said in a report published October 1, 2026. The heist ranks as the largest crypto exchange hack reported this year and adds another major analytics firm to those pointing at Pyongyang.

The attack hit on September 24, 2026. Bitget detected unauthorized transfers at 18:31 UTC. Attackers did not steal private keys. They compromised a backend wallet system, letting them spoof transaction data and trick Bitget's own authorization checks into approving the withdrawals.

How did the breach unfold?

Losses spread across Ethereum, XRP Ledger, Zcash, and Tron. Cold wallets stayed secure throughout the incident. The damage estimate also grew: first reported at $351.6 million, later revised upward to $387.5 million.

XRP took the heaviest single-asset hit. Roughly 103 million tokens, worth about $157 million, left the exchange. In the first three hours after detection, XRP accounted for roughly 40.8% of every asset drained.

Where did the XRP go?

Chainalysis mapped 23 distinct transfers. Much of the XRP moved through cross-chain liquidity protocols such as THORChain, where it was swapped into Bitcoin.

The firm said its in-house AI tools accelerated the chase. Manual bridge analysis that once consumed more than 20 hours now runs in under 10 minutes, according to Chainalysis.

That speed has not yet translated into recovered assets. Only about 0.2% of the stolen funds have been frozen by issuers or protocols so far. The gap between tracing time and recovery time remains the operational sore point for compliance teams.

Why the North Korea attribution?

Bitget did not wait for outside analysts. CEO Gracy Chen quickly flagged a connection to North Korean state-linked groups, pointing to matching IP addresses and familiar on-chain activity patterns.

TRM Labs and Elliptic both reached the same conclusion in their own investigations, linking the breach to earlier incidents involving DPRK hackers. The Bitget theft pushes a grim tally higher: suspected North Korean digital asset thefts have totaled over $1 billion in 2026 alone, crossing a threshold that puts 2026 on track to rival the worst years on record.

Will users be made whole?

Bitget has pledged to absorb the entire loss. The exchange says its User Protection Fund sits at roughly $464 million and will fully cover the shortfall. Customer balances will not be affected, according to the company.

With almost none of the stolen assets frozen, the cost of replenishing users is money the exchange is unlikely to recover. The incident becomes a pure insurance loss absorbed by the platform.

What is the operational takeaway?

The most uncomfortable detail is that no private keys were stolen. By corrupting the systems that judge whether a withdrawal looks legitimate, the hackers made the exchange approve its own robbery. That bypasses the security narrative exchanges have relied on for years.

Chainalysis's tracing gains hint at an arms race. Attackers lean on instant swaps and cross-chain hops to scatter funds. Analytics firms automate the chase. The question now is whether bridge operators and stablecoin issuers will build the freeze coordination required to push that 0.2% recovery rate higher.

Watch the freeze rate in the coming weeks. Any meaningful rise would mark the first evidence that faster on-chain tracing is starting to translate into recovered assets rather than just faster documentation of the loss.