Issuers and protocols have frozen about 0.2% of the $387 million taken from Bitget
Chainalysis tied the $387 million Bitget hack to North Korea-linked hackers, saying it pushed their 2026 crypto theft past $1 billion. Its AI cut more than 20 hours of tracing to minutes, while the bill falls on a Bitget user fund the exchange puts above $464 million.
The Investor · Invest desk
What happened
- Within three hours the money left Bitget in 23 transfers, landing 49.7% on Ethereum, 40.8% on XRP, 7.6% on Zcash and 1.8% on Tron.
- The attackers took no private keys; they compromised a backend wallet system and spoofed data so Bitget's own checks approved the withdrawals.
- Much of the stolen XRP was pushed through cross-chain liquidity protocols such as THORChain and converted into Bitcoin.
- Bitget's loss was first estimated at $351.6 million before being revised up to $387.5 million.
Why it matters
- What it costs cost Bitget's fund absorbs the loss so its customers do not, and with so little held by issuers or protocols, almost none of that payout is likely to come back.
- What it limits constraint Faster tracing cannot hold coins, so recovery depends on swap venues and issuers choosing to act, and Thorchain, a main route for the stolen XRP, kept processing.
- Who's exposed exposure Any exchange whose withdrawal approvals trust backend transaction data is open to the same attack, because this one drained hot and warm wallets without needing a private key.
Next story · Invest · Sep 30
Bitget's hackers push $3.9 million of stolen ZEC into Zcash's untraceable Ironwood poolConfirmed2 publishers
Going by Chainalysis's own wording, the Bitget theft is between about 28% and 39% of everything North Korea-linked groups have stolen in crypto this year [25]. A $387.5 million theft [7] that pushed the 2026 total past $1 billion [1] means the year's earlier thefts added up to between roughly $612.5 million and $1 billion [25]. Earlier assessments had already pointed the same way. Bitget CEO Gracy Chen cited matching IP addresses and familiar on-chain patterns, and TRM Labs tied the breach to earlier DPRK incidents [5]. Elliptic called the link "highly likely" [6].
Chainalysis estimated that manual bridge reconciliation would take more than 20 hours. That is more than six times the three-hour window in which the money scattered [26]. The firm stressed that humans still directed the work [4]. On the first move, then, tracing by hand could not keep up. The XRP leg was slower. Tens of millions of dollars took roughly a day and a half to pass through a cross-chain liquidity protocol and come out as Bitcoin in attacker-controlled addresses [2]. A manual reconciliation of 20-odd hours would have fit inside that window [27].
Tracing finds the coins, but recovering them needs a venue that will hold them. Circle and Tether froze roughly $318,000 in stablecoins [12], about 0.08% of the loss [18]. Crypto Briefing puts the share frozen by issuers or protocols at about 0.2% [14], or roughly $775,000 [19]. The two reports do not itemise the difference. The swaps Near Intents rejected [13] came to more than 60 times that frozen total [23], and a rejected swap leaves the coins with the sender.
So the bill sits with Bitget. The exchange has pledged that its User Protection Fund, which it says holds more than $464 million, will cover the loss in full, and that customer balances will not be affected [15]. A $387.5 million payout uses about 84% of that stated floor and leaves at least $76.5 million, roughly a sixth [20]. The upward revision of the loss estimate added $35.9 million, about 10%, to the bill [21]. Bitget is choosing not to push any of the loss onto customers. Crypto Briefing wrote that the money spent replenishing users "is money the exchange is unlikely to see again" [16].
There are two places where that could change. The Zcash leg, about $29 million on Chainalysis's split [22], is where the attacker began hiding funds in the shielded pool [17]. The watched Bitcoin addresses are the other. I'd expect the frozen share to stay under 1% of the loss, or about $3.9 million [24]. That view is wrong if the Bitcoin addresses now under watch, which took in tens of millions of dollars of converted XRP [2], send coins to a venue that freezes them.
What to watch
- Whether coins from the attacker-controlled Bitcoin addresses under watch reach a venue that freezes them.
- Whether Thorchain starts refusing swaps tied to the hacker, as Near Intents did before it was hacked.
- Any further revision to the $387.5 million loss estimate, and the protection fund balance Bitget reports after paying out.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption25
- Hype gap+35
- Incentives60
- Confidence65
Perspective Coverage
3 publishers- Builder
- Builder 32%
- Operator
- Operator 41%
- Investor
- Investor 27%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Chainalysis attributed the Sept. 24 Bitget breach to North Korea-linked actors, saying the heist pushed the total value of crypto stolen by North Korea-linked groups in 2026 past $1 billion.
- [2]
The attackers pushed stolen XRP through a cross-chain liquidity protocol and pulled Bitcoin out the other side, with tens of millions of dollars moving that way over roughly a day and a half before reaching attacker-controlled Bitcoin addresses now under watch.
- [3]
Much of the stolen XRP was pushed through cross-chain liquidity protocols such as THORChain and converted into Bitcoin.
- [4]
Chainalysis said custom in-house AI automation compressed an estimated more than 20 hours of manual bridge reconciliation into under 10 minutes, and stressed the technology accelerated its investigators rather than replacing them, with humans still directing the work.
- [5]
In earlier assessments, Bitget CEO Gracy Chen flagged a connection to North Korean state-linked groups, pointing to matching IP addresses and familiar on-chain activity patterns; TRM Labs and Elliptic linked the breach to earlier incidents involving DPRK hackers.
- [6]
Elliptic called a DPRK link "highly likely."
- [7]
The heist drained approximately $387.5 million from Bitget's hot and warm wallets; it is the largest crypto exchange hack reported in 2026, and Bitget's cold wallets stayed secure.
- [8]
In the first three hours, $387 million left Bitget across 23 transfers and landed on four networks: Ethereum 49.7%, XRP 40.8%, Zcash 7.6% and Tron 1.8%.
- [9]
The attackers did not steal private keys; they compromised a backend wallet system that let them spoof transaction data and trick Bitget's own authorization checks into approving the withdrawals.
- [10]
The damage estimate was first put at $351.6 million before being revised to $387.5 million.
- [11]
XRP was the single biggest casualty: roughly 103 million XRP, worth about $157 million, left the exchange.
- [12]
Circle and Tether froze roughly $318,000 in stablecoins.
- [13]
Near Intents rejected more than $50 million in swaps tied to the hacker, only to be hacked itself days later, while Thorchain kept processing.
- [14]
Only around 0.2% of the stolen funds have been frozen by issuers or protocols so far.
- [15]
Bitget's User Protection Fund is valued at roughly $464 million, a level the exchange says the fund sits above; Bitget has pledged the fund will fully cover the loss and says customer balances will not be affected.
- [16]
With almost none of the stolen assets frozen, the money spent replenishing users is money the exchange is unlikely to see again.
- [17]
The attacker began hiding funds in Zcash's shielded pool.
- [18]
The $318,000 frozen by Circle and Tether is about 0.08% of the $387.5 million loss.
- [19]
About 0.2% of $387.5 million is roughly $775,000.
- [20]
A full $387.5 million payout uses about 84% of the fund's stated $464 million floor and leaves at least $76.5 million, roughly a sixth.
- [21]
The revision from $351.6 million to $387.5 million added $35.9 million, about 10%.
- [22]
The Zcash share of the loss was about $29 million.
- [23]
The more than $50 million in swaps Near Intents rejected is more than 60 times the roughly $775,000 counted as frozen.
- [24]
1% of the $387.5 million loss is about $3.9 million.
- [25]
Earlier 2026 North Korea-linked thefts summed to between about $612.5 million and $1 billion, so Bitget is between about 28% and 39% of the year's total.
- [26]
Chainalysis's 20-plus-hour manual estimate is more than six times the three-hour window in which the funds scattered.
- [27]
A manual reconciliation of a little over 20 hours would have fit inside the roughly 36-hour window the XRP took to reach Bitcoin addresses.
Sources
3 independent publishers whose own reporting we read for this story.
- crypto.newsChainalysis AI traces $387M Bitget hack in under 10 minutes
1 article · October 3, 2026
- cryptobriefing.comChainalysis links most of the stolen XRP in $387M Bitget hack to North Korea
1 article · October 2, 2026
- decrypt.coChainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea
1 article · October 3, 2026
Topics and entities
Topics
- Blockchain Analytics and Forensics
- Crypto Exchange Security Operations
- North Korea Crypto Theft
- Cross-chain laundering