CHAINALYSIS PINS BITGET’S $387 MILLION THEFT ON NORTH KOREA — ITS POST SHOWS HOW IT TRACED THE MONEY — NOT HOW IT NAMED THE THIEF

Chainalysis says North Korea took the $387 million that left Bitget on September 24, 2026. Its October 1 post calls it a "DPRK-attributed attack" and says the theft pushes North Korea's 2026 crypto haul past $1 billion.

Most of the post is the trail, and the trail can be checked. In the first three hours, $387 million left Bitget in 23 transfers across four chains: Ethereum 49.7%, XRP 40.8%, Zcash 7.6% and Tron 1.8%. The XRP went through a cross-chain swap and came out as bitcoin, in addresses Chainalysis says it is watching. Its in-house AI did more than 20 hours of bridge matching in under 10 minutes, by its own estimate.

The name is a different kind of claim. The post never says what ties these wallets to North Korea. No group is named and no past attack is linked. Bitget's CEO said in September that some IP addresses matched the VPN choices of a North Korean group. That may be right. A ledger shows where money went. It can't show who was at the keyboard.

What you can check here: 23 transfers, four chains, bitcoin addresses at the end. What you are asked to trust: the name on it. At the time of this writing, bitcoin was $85,253.