Chainalysis links most of the stolen XRP in $387M Bitget hack to North Korea

Chainalysis has tied most of the XRP stolen in the Bitget hack to North Korea. That adds another major name to a growing list of firms pointing at Pyongyang. The heist drained approximately $387.5 million from the exchange’s hot and warm wallets. It is the largest crypto exchange hack reported in 2026. How the Bitget breach unfolded The attack hit on September 24, 2026. Bitget detected unauthorized transfers at 18:31 UTC. The attackers did not steal private keys. They compromised a backend wallet system instead. That access let them spoof transaction data and trick Bitget’s own authorization checks into approving the withdrawals. The losses spread across several blockchains, mainly Ethereum, XRP Ledger, Zcash, and Tron. Bitget’s cold wallets stayed secure. The damage estimate also grew after the fact. The figure was first put at $351.6 million before being revised to $387.5 million. XRP was the single biggest casualty. Roughly 103 million XRP, worth about $157 million, left the exchange. Following the money across chains Chainalysis published its findings on October 1, 2026. The report focused heavily on the stolen XRP and on how quickly it moved. The funds were split into 23 disti...