Chainalysis Traced Bitget's $387.5M Theft Across Four Chains in Minutes

Chainalysis says it followed the money from the 24 September Bitget theft across four blockchains in under 10 minutes. In a post dated 1 October, the blockchain analytics firm set out the tooling behind that trace and attributed the breach to North Korea-linked actors. The same post carries the firm's estimate of North Korea-linked crypto theft in 2026 above $1 billion. Five outlets picked it up on 3 October. None of them gives an exact figure for that annual total, and the firm did not publish one.

Three totals still in circulation

The size of the theft has never settled. Bitget disclosed $351.6 million on the Thursday it happened, then raised the tally to $387.5 million two days later and called the difference a recount. Its own postmortem, which traced the breach to a zero-day in a vendor's security tool, gave $388 million. Chainalysis uses $387 million in the title of its post. The figure in crypto.news, CoinGape and Cryptonomist on 3 October was $387.5 million. Three numbers for one theft are in live circulation nine days on, and nothing read here reconciles them.

Twenty hours of bridge work, done in ten minutes

The claim Chainalysis leads on is speed. Matching funds as they cross between blockchains, the step that defeats a plain address-to-address trace, normally takes its investigators more than 20 hours. Custom automation built on over a decade of cross-chain attribution data brought that under 10 minutes, the firm said. crypto.news, CoinGape and Cryptonomist all carry the same two timings. The firm was careful about what the tooling did not do.

"Our investigators still defined the logic, reviewed the outputs, and directed the investigation," the report said.

Where the XRP went

The money left in 23 transfers inside the first three hours. Ethereum took 49.7% of it, XRP 40.8%, Zcash 7.6% and Tron 1.8%, a split that appears identically in four accounts read here. Rather than push the stolen XRP straight to an exchange, the attackers deposited it into a cross-chain liquidity protocol and withdrew bitcoin on another network, on BeInCrypto's account. crypto.news describes investigators following that same leg to bitcoin addresses within three hours. CoinGape alone sizes the XRP at $157 million and calls it the largest single asset, which does not quite work against the percentage: 40.8% of $387.5 million is about $158.1 million. BeInCrypto is also the only account read here to time the conversion, at roughly 36 hours. That duration stands unverified.

How far the attribution goes

Chainalysis is a private firm and this is its own finding. No agency comment appears in any account read here. The exchange has not matched the firm's confidence either. CoinGape reports that chief executive Gracy Chen flagged IP and VPN patterns consistent with Lazarus-style activity while stopping short of formal confirmation, which leaves the analytics firm and the victim saying different things at different strengths. BeInCrypto names two other 2026 incidents it places in the same tally, Drift Protocol at $285 million on 1 April and KelpDAO at $292 million on 18 April. Both dollar figures match what this desk reported at the time; the shared attribution is BeInCrypto's and no other account read here repeats it.

Recovery is thin either way. Circle and Tether froze about $318,000 in stablecoins by 26 September, against the 5% bounty Bitget offered for freezing funds and a further 5% for returning them. What the Chainalysis post changes is not the balance sheet but the clock: if cross-chain matching now takes minutes, the window in which stolen funds can be moved unnoticed is the thing that shrinks.