Blockchain analytics firm Chainalysis stated that the $387 million Bitget hack was carried out by threat actors linked to North Korea. Within the first three hours, the stolen funds were moved across Ethereum, XRP, Zcash, and Tron through 23 transfers, with Ethereum and XRP accounting for 49.7% and 40.8% respectively. Investigators also traced tens of millions of dollars in stolen XRP through cross-chain liquidity protocols into Bitcoin over approximately a day and a half. This attack has pushed the total amount of DPRK-linked crypto thefts in 2026 above $1 billion.