Chainalysis said the $387 million Bitget hack was carried out by DPRK-linked threat actors. Within the first three hours, the stolen funds moved across Ethereum, XRP, Zcash and Tron through 23 transfers, with Ethereum and XRP accounting for 49.7% and 40.8% respectively. Investigators also traced tens of millions of dollars in stolen XRP through cross-chain liquidity protocols into Bitcoin over roughly a day and a half. The attack has pushed total DPRK-linked crypto thefts in 2026 above $1 billion.