New Clue in $387 Million Bitget Attack: Some Stolen Funds Moved Into Bitcoin!

Chainalysis reported that North Korea-linked actors were behind the $387 million attack on Bitget, and that tens of millions of dollars’ worth of stolen XRP was converted into Bitcoin in about a day and a half.

Chainalysis findings, cited by Wu Blockchain, shed new light on the route taken by the funds after the Bitget attack. According to the blockchain analytics firm, North Korea-linked threat actors were behind the attack.

23 transfers were made in the first three hours

The investigation found that a total of $387 million was transferred out of Bitget in 23 transactions within the first three hours. About half of the funds moved through Ethereum, nearly 41% through XRP, and the remainder was split between Zcash and Tron.

The report gave the breakdown as 49.7% for Ethereum, 40.8% for XRP, 7.6% for Zcash, and 1.8% for Tron.

The route from XRP to Bitcoin

Researchers found that tens of millions of dollars’ worth of stolen XRP was routed through liquidity protocols that enable swaps between different blockchains. They tracked the acquisition of Bitcoin in exchange for these funds over approximately a day and a half.

As a result, some of the assets stolen in the attack were moved to a different network from the one on which they were first withdrawn. This finding relates to the XRP funds that were tracked, not the entire $387 million.

North Korea-linked thefts exceed $1 billion

According to Chainalysis, with the addition of the Bitget attack, the total amount stolen in crypto thefts attributed to North Korea-linked actors in 2026 exceeded $1 billion. The new assessment identifies the attackers’ links and traces the movement of the funds; it does not say that the tracked assets have been recovered.