Bitget Hack: $387M Stolen, North Korea Link Identified

Bitget says it lost about $351.6 million in unauthorized transfers, while Chainalysis values the theft at $387 million and attributes it to North Korea-linked actors. The exchange said its $464 million User Protection Fund would cover the loss, but no recovered funds have been confirmed.

That recovery claim matters because it would change who bears the loss. Nothing in the available reporting confirms that any stolen Bitget funds have returned, and no source links returned money to the separate $3.8 million NEAR Intents exploit.

What Happened to the $387 Million

Chainalysis said that DPRK-attributed threat actors stole $387 million from Bitget on September 24, 2026. It said the theft pushed crypto stolen by North Korea-linked actors during the year past $1 billion.

The figures differ. TRM Labs put the loss at about $351.6 million, based on funds moved from Bitget's hot and warm wallets across seven blockchains. The available reports do not explain the gap between the two estimates.

TRM said Bitget detected the transfers at 18:31 UTC and paused withdrawals. The exchange said cold wallets were unaffected.

How the Funds Moved

Chainalysis traced $387 million leaving Bitget in 23 transfers within three hours. The funds landed across four chains:

• Ethereum: 49.7%
• XRP: 40.8%
• Zcash: 7.6%
• Tron: 1.8%

The attackers did not send the stolen XRP directly to an exchange. Chainalysis said they used a cross-chain liquidity protocol to obtain Bitcoin, which then reached attacker-controlled addresses under monitoring. The available reporting identifies THORChain as the protocol used to swap the XRP.

TRM also found that funds on BNB Chain and Ethereum were swapped through THORChain. It said the assets were then split across Bitcoin addresses in peel chains, a method for spreading funds through sequential transfers.

Chainalysis said its in-house AI tools reduced more than 20 hours of manual bridge reconciliation to under 10 minutes.

Why Bitget's Keys May Not Matter

Bitget did not report a private-key theft. It said the attackers compromised a backend system, manipulated the transaction data shown to the authorization process, and caused it to approve the transfers.

That is a different failure from an exchange losing its signing keys. The authorization system was presented with altered transaction data, so the exchange approved transfers that were not part of the legitimate process.

The distinction may matter to account holders. It means the incident was not limited to a compromised cold wallet, although Bitget has said the affected hot and warm wallets were covered by its User Protection Fund.

North Korea Link Is Strong, but Not Final

Chainalysis attributes the theft to DPRK-linked threat actors. Bitget CEO Gracy Chen has also called North Korean involvement very likely, citing IP addresses linked to VPN services associated with a North Korean hacking group.

TRM is more cautious. It has not definitively attributed the attack, although it found on-chain links to previously identified North Korean thefts, including the Bybit and AFX Bridge incidents. Those links point toward North Korean involvement, but they do not amount to a confirmed attribution from a law enforcement agency.

The return of the funds remains the central unresolved issue. No available source confirms that Bitget has recovered any money from the attackers, and the available reporting does not connect any recovery to the separate NEAR Intents incident.

The NEAR Intents Return Is a Separate Matter

NEAR Intents reported a theft of about $3.8 million. Its general manager, Alex Shevchenko, identified the attacker, posted three addresses for the return of the funds and gave the attacker 48 hours to cooperate.

The exploiter sent 1 BNB to a recovery wallet. As of early October 2, none of the three posted addresses had received the full returned funds, according to the available report.

That incident is far smaller than the Bitget theft and involves a different protocol and victim. The available evidence does not support a link between the two cases.