Investigators Trace $387M Bitget Theft to North Korean Threat Actors Across Multiple Blockchains

Blockchain analysis firm Chainalysis attributed a $387 million hack of cryptocurrency exchange Bitget to actors associated with North Korea, tracking 23 transfers across Ethereum, XRP, Zcash, and Tron within three hours. The stolen funds were distributed with the majority on Ethereum at 49.7%, followed by XRP at 40.8%, with smaller portions on other networks, as attackers rapidly moved assets between chains. Investigators used automated tools to trace the complex transaction paths and identified the Bitcoin addresses where the stolen assets were ultimately consolidated for monitoring by law enforcement.

The investigation demonstrates how sophisticated cross-chain fund movement complicates theft recovery. Within 36 hours, attackers distributed assets across multiple blockchain networks, strategically selecting routes based on each chain's characteristics. The use of cross-chain liquidity protocols—rather than traditional centralized exchanges—created additional layers of complexity, as stolen tokens could be swapped for different assets without leaving obvious digital footprints at single locations.

Chainalysis's automation capabilities proved crucial for tracking the heist's scope. Manual analysis would have required more than 20 hours to reconcile transactions across separate blockchains; the firm's specialized tools compressed this work to under 10 minutes. This efficiency allowed investigators to identify Bitcoin consolidation addresses and establish patterns linking the activity to North Korean actors, though the attribution remains general without identifying a specific threat group.