🚨 $387.5M Bit-get hack: stolen $XRP became Bitcoin — and investigators are still following the money
The hack itself happened on Sep 24, so that isn't the new story.
The new story is who investigators believe was behind it — and how the money moved
Chainalysis has attributed the attack to DPRK-linked hackers, pushing crypto stolen by North Korea-linked actors in 2026 to more than $1B. Instead of sending stolen XRP straight to a centralized exchange, the attackers routed it through a cross-chain liquidity protocol and emerged on the other side in $BTC
🕵️ BitOK's latest traced snapshot adds another layer: as of Oct 1, one branch still held about 87.82 BTC across 10 unspent outputs.
Other traced funds had already entered Wasabi CoinJoin and Tornado Cash, making attribution progressively harder as the trail fragmented
Bit-get says its phased withdrawal restoration was fully completed on Oct 2. So the exchange-side operational story is stabilizing — but the on-chain investigation is still very much alive
What stands out here isn't just the size of the hack
It's how quickly stolen assets can move across chains, across assets and into privacy infrastructure — while investigators try to reconstruct the path behind them
⚠️ Moving the money doesn't necessarily erase the trail. It just makes following it much harder
#CryptoSecurity
The hack itself happened on Sep 24, so that isn't the new story.
The new story is who investigators believe was behind it — and how the money moved
Chainalysis has attributed the attack to DPRK-linked hackers, pushing crypto stolen by North Korea-linked actors in 2026 to more than $1B. Instead of sending stolen XRP straight to a centralized exchange, the attackers routed it through a cross-chain liquidity protocol and emerged on the other side in $BTC
🕵️ BitOK's latest traced snapshot adds another layer: as of Oct 1, one branch still held about 87.82 BTC across 10 unspent outputs.
Other traced funds had already entered Wasabi CoinJoin and Tornado Cash, making attribution progressively harder as the trail fragmented
Bit-get says its phased withdrawal restoration was fully completed on Oct 2. So the exchange-side operational story is stabilizing — but the on-chain investigation is still very much alive
What stands out here isn't just the size of the hack
It's how quickly stolen assets can move across chains, across assets and into privacy infrastructure — while investigators try to reconstruct the path behind them
⚠️ Moving the money doesn't necessarily erase the trail. It just makes following it much harder
#CryptoSecurity
