Chainalysis Attributes $387.5 Million Bitget Hack to North Korea as Stolen Funds Shift to Bitcoin

North Korea-linked hackers are actively converting proceeds from Bitget's $387.5 million exploit into Bitcoin using cross-chain protocols such as THORChain and Chainflip. The breach, which hit Bitget on September 24-25, 2026, compromised backend wallet systems to siphon assets across Ethereum (49.7%), the XRP Ledger (40.8%), Zcash (7.6%), and Tron (1.8%). Attackers have converted more than 90.5% of the 103 million stolen XRP into Bitcoin, with only about 0.2% of stolen funds frozen. Bitget stated customer balances remain safe, backstopped by its $464 million User Protection Fund.