Chainalysis attributes $387 million from the Bitget hack to North Korea: what matters now for investors in Germany

The breach at the crypto exchange Bitget of September 24, 2026 now has a sender: in early October the analytics firm Chainalysis attributed the theft of around $387 million to actors with ties to the Democratic People's Republic of Korea. For you as an investor in Germany that attribution changes nothing about your balance, but it does change the risk assessment: anyone who suspects a state-backed team behind an attack expects a series rather than an isolated case. This piece sorts out what is documented, and what follows from it for custody, choice of exchange and record-keeping.

$387 million in 23 transfers: how the Bitget hack unfolded

The attack of September 24, 2026 hit a hot wallet of the exchange, meaning a holding that is permanently connected to the internet and services withdrawals. A hot wallet is the counterpart to a cold wallet, whose keys sit offline. That very reachability makes it a target: whoever controls the keys can transfer immediately.

On Chainalysis's account, around $387 million left the exchange within three hours, spread across 23 individual transfers. Depending on the report the sum is given as $387 million to $388 million; the range comes from different valuation moments for the tokens that were moved. Three hours is a long time in this context. It is enough to spread money across several networks, and it is not enough to freeze it if nobody is watching.

The exchange reacted in stages. Withdrawals stood still at first, after which Bitget says it reopened them step by step from September 28. As cryptoticker.io reported on September 29, 2026, customers pulled out a net total of around $463 million in the days that followed, which is more than the attack itself cost. That is the second damage of a hack, and it hits the exchange, not the attacker.

The attribution to DPRK-linked actors and its limits

An attribution in blockchain forensics is neither a confession nor a court ruling. It is a statement of probability resting on patterns: recurring addresses, known exchange services, typical sequences used in obfuscation, windows of activity. Chainalysis works with a stock of addresses that has grown over years out of investigations, exchange data and its own observations.

What holds up in such an attribution is that money trails can be reconstructed. What holds up less well is any statement about who sat at the keyboard. The analysts' wording therefore stays deliberately cautious and speaks of actors with ties to the DPRK, not of an authority or a person named outright. You should read that caution along with the finding whenever headlines turn an attribution into a fact.

For practical purposes the cautious version is enough. Whether an attacker is state-funded or not changes the probability that the same method resurfaces in three months. State-backed teams work for the long term, with a budget and with patience.

Ethereum, XRP, Zcash and Tron: the four chains in the outflow

The money did not stay in one network. Chainalysis puts the distribution across four chains: 49.7 percent flowed over Ethereum, 40.8 percent over XRP, 7.6 percent over Zcash and 1.8 percent over Tron. That split is not a coincidence but a division of labour.

Ethereum carries the deepest liquidity and most of the decentralised trading venues where tokens can be swapped without opening an account. XRP delivers fast and cheap transfers with short confirmation times. Zcash allows shielded transactions in which the amount and the parties stay hidden in the protocol. Tron is a widely used route for stablecoin movements at low cost.

The Zcash share is the most delicate part of the trail. As early as September 30, 2026, cryptoticker.io described how 2,746 ZEC from this complex moved into a shielded pool. What goes in there cannot be followed any further from outside as long as it stays in. What remains to be watched is the exit: at some point money has to reach an exchange in order to become national currency, and that is where identity checks and anti-money-laundering supervision apply.

To put the orders of magnitude in context: Zcash traded at around $1,336 on Sunday evening, a good 17 percent below the level of the previous week, Ethereum at about $2,706 and XRP at around $1.51, in each case according to CoinGecko. The prices say nothing about the hack; they only show how large the markets were through which the money ran.

Cross-chain bridges and mixers: where the money went after the outflow

After the outflow the second phase begins, the obfuscation. Chainalysis names four tools for it: bridges, cross-chain liquidity protocols, mixers and decentralised exchanges. A bridge is a service that locks a value in one network and releases an equivalent in another. It does not break the trail, but it cuts it into two parts that have to be reassembled first.

A cross-chain liquidity protocol goes one step further. On this account the investigators followed stolen XRP through such a protocol, which paid out Bitcoin at the end instead of sending the tokens straight to an exchange. From a tracing perspective that means: the same money leaves the service in a different currency and in a different network, and the connection consists only in the closeness in time and in the size of the amounts.

A mixer, in turn, pools deposits from many users and pays them out freshly mixed. Decentralised exchanges, finally, swap tokens without any account being opened. None of these tools is forbidden in itself, and each has legitimate uses. Chained one after another they produce a sequence that costs investigators time. It is precisely that time the technical part of the report addresses.

One billion dollars in 2026: the tally of DPRK-attributed thefts

With the Bitget case, the sum of crypto thefts that Chainalysis attributes to groups with DPRK ties in 2026 passes the mark of one billion dollars. That figure is an annual total from several incidents, not an assessment of a single attack.

A look at the market as a whole helps to place it. On October 2, 2026 cryptoticker.io reported that losses from crypto hacks in the third quarter of 2026 came to $1.26 billion in total, the highest level of any quarter. A single incident of $387 million accounts for just under a third of that. Concentration of this kind is the more important information for investors than the annual total, because it shows where the risk sits: with large, centrally custodied holdings.

What makes an exchange hot wallet so attractive

An exchange has to be able to pay out at any time. For that it keeps part of its client holdings in wallets whose keys sit on systems reachable online. The larger the exchange, the larger that pot. An attacker who gets inside once reaches more in a single go than they would take in a hundred attacks on individual users. That is the structural reason why exchange holdings are regularly the target of such operations, and no attribution changes it.

AI-assisted tracing cuts bridge matching to under ten minutes

The second notable part of the report concerns the tool, not the perpetrator. Chainalysis states that it deployed an in-house AI automation in order to match transfers across bridges to one another. That matching is manual work: for every entry on one chain you look for the matching exit on the other, via timestamps, amounts and fees. According to the firm, a task that would have taken more than 20 hours shrank to under ten minutes.

That figure comes from the provider itself and cannot be verified from outside. It is plausible nonetheless, because pattern recognition across large volumes of data is exactly the strength of such methods. The consequence is a shift in tempo: obfuscation stays cheap, tracing gets faster. Anyone sending money through five stations now gains hours rather than weeks.

For you this has a tangible side effect. The faster addresses are flagged as tainted, the more likely an exchange is to freeze affected deposits. That also hits users who happened to receive tokens through a decentralised swap that was fed with flagged funds. Anyone swapping larger amounts via unknown counterparties carries that risk too.

What the hack means for a balance held on a crypto exchange

The most important distinction is the one between possession and claim. If your coins sit with an exchange, you hold no keys. You hold a claim against the company. As long as the company works, you never notice the difference. If it fails, its solvency decides whether you get your balance back.

No blanket verdict against exchanges follows from that. Without an exchange there is no way to buy, and for small amounts in constant motion custody there is practical. The question is the size. An amount whose loss would genuinely hurt you belongs in a form of custody where you hold the key. Which devices do that and how the models differ is shown by our hardware wallet comparison with the current terms.

A second point concerns spreading. Several smaller holdings with different providers lower the risk of a single failure but raise the effort for records and fees. There is no solution here without a drawback, only a decision that fits your own sum.

Protection fund, reserves and withdrawal deadlines at Bitget

After the attack, Bitget says it topped its protection fund back up to around $309 million. A fund of that kind is a voluntary reserve held by the company, not a deposit guarantee scheme. There is no statutory guarantee behind it, no claim to compensation and no authority that steps in if it fails. The size of a fund says something about a provider's intention, nothing about an assurance.

Equally important is the question of records. Reserve attestations, often called proof of reserves, show at one point in time that holdings exist. They do not show that no liabilities stand against them. A complete proof would need both sides of the balance sheet and an independent audit. So anyone reading a reserve statement is reading a snapshot.

MiCA licence and the BaFin register: the legal framework in Germany

Since the EU-wide transitional period ended on July 1, 2026, every provider delivering crypto-asset services in Germany needs a licence. The basis is the European regulation on markets in crypto-assets, MiCA for short, supplemented in Germany by the Crypto Markets Supervision Act. Which obligations that brings for providers is something our overview of the MiCA licence and its duties sets out.

In practice that means two things. First, there is a register in which you can check whether a company is supervised: BaFin's company database lists licensed institutions and is open to the public. Second, a licence does not mean that a provider is safe against attacks. It means that there are requirements on organisation, own funds and complaint channels, and a supervisor that can intervene.

An attack on an exchange outside this framework has an unpleasant consequence for you: there is no body you can turn to. With a provider licensed in the EU, the regulation sets deadlines for handling complaints. With a provider without a licence, what remains is the route through a foreign court, and for small sums that route is effectively barred.

Self-custody, seed phrase and hardware wallet: holding coins outside the exchange

Self-custody means that you hold the private keys yourself. As a rule a recovery phrase secures it, the seed phrase, usually twelve or 24 words. Whoever has those words has the coins. The whole practice follows from that: the phrase is generated on the device, it is never typed out, never photographed, never stored in a cloud and never entered into a form that asks for it.

A hardware wallet is a device that generates the key and confirms transactions without handing it over. It protects against attacks on your computer and against the failure of an exchange. It does not protect against the loss of the recovery phrase and not against a signature you give yourself on a faked page.

The quiet tax question when you move

Moving your own coins from an exchange into your own wallet is not a sale and triggers no tax in Germany, because there is no disposal. What matters are the records: the acquisition date and the acquisition cost do not travel with them automatically. Anyone who wants to prove the one-year holding period later needs the original statements. So pull the documents out before an account is closed, because after that access to the history is often gone.

Fake job offers as a way in: the second DPRK method

Alongside attacks on exchange systems stands a second method that hits individual users and developers. On September 19, 2026 cryptoticker.io described how malware was distributed via fake job offers and supposed interviews, with which wallets could be emptied. The pattern is always similar: an attractive offer, a file or a code project you are supposed to run locally, and time pressure that cuts the thinking short.

The protection against it is banal and effective. Someone else's code does not run on the machine that holds a wallet. Anyone working with crypto professionally separates the work device from custody. And no serious employer asks for a recovery phrase, a wallet export or a test transfer.

The link to the Bitget case lies in the goal, not in the technique. The same annual total of more than a billion dollars is fed by both routes: the big breach at a custodian and the patient work on individual keys.

Bitget hack: Your next three steps

1. Sort the place of custody by size of amount. Decide which sum you leave sitting on an exchange and shift the rest into your own wallet. If you need an exchange with an EU licence as a starting point, you will find the licensed providers in our overview of regulated crypto exchanges.
2. Harden access and recovery. Two-factor protection via an app instead of by SMS, your own withdrawal address list and a recovery phrase that exists only on paper or metal. For smaller amounts without a dedicated device, the software wallet comparison shows which apps keep the keys locally.
3. Secure your records while you still have access. Pull statements, purchase dates and transfer receipts from every account you shrink or close. A portfolio tracker does this on an ongoing basis; which tools carry the holding period per account is in our overview of crypto tax tools.

The attribution of the theft changes nothing about your holding. It changes the expectation: an opponent with a budget and patience comes back, and the cheapest precaution remains not holding everything in one place. Decrypt described the attribution in detail.

(As of October 4, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)