North Korea's crypto haul passes 1 billion dollars this year after the Bitget hack

One of the largest crypto exchange hacks of the year now has a name attached to it. Chainalysis has linked the theft of roughly 388 million dollars from Bitget to North Korean hackers, and says the attack pushed North Korea linked crypto thefts above 1 billion dollars in 2026, as reported by The Defiant.

For victims, the news is bleak. Bitget has frozen only about 1.1 million dollars of the stolen funds, and its chief executive has said she is not expecting to recover a lot. Once North Korean hackers move stolen crypto through their laundering networks, recovering it has historically proved almost impossible.

What happened at Bitget

Bitget, one of the world's largest crypto exchanges by trading volume, disclosed the hack in late September. The loss was initially reported at about 351.6 million dollars, and Bitget said it suspected North Korea was responsible, as reported by CNBC. The estimate was later revised to roughly 388 million dollars as the full scope became clear.

Chainalysis, the blockchain analytics firm, subsequently attributed the theft to North Korean hackers. Attribution in crypto hacks relies on tracing how stolen funds move, the techniques used and links to wallets previously associated with known groups. North Korea's hacking units have distinctive patterns that analysts have learned to recognise.

Recovery efforts have so far yielded little. Bitget froze about 1.1 million dollars, a tiny fraction of the total, and its chief executive was candid about the outlook, saying she does not expect to recover much of the stolen funds.

North Korea's crypto machine

North Korea has turned crypto theft into a major source of revenue. According to Chainalysis, the country accounted for about 59 percent of the more than 3.4 billion dollars in crypto stolen in 2025. Its hackers target exchanges, decentralised finance protocols and individual holders, and they have become increasingly sophisticated.

The 2026 tally was already large before Bitget. TRM Labs estimated that North Korean hackers stole 643 million dollars in the first half of the year, including about 577 million dollars from attacks on Drift Protocol and KelpDAO in April, according to NK News. The Bitget theft pushed the total past 1 billion dollars, by Chainalysis's count.

For North Korea, a crypto exchange is not a target of opportunity but a revenue stream, and it plans accordingly.

The money matters beyond crypto. United Nations experts and governments have long said that North Korea uses stolen crypto to fund its weapons programmes and evade sanctions. Every successful hack strengthens a sanctioned regime, which is why exchange security has become a national security issue as well as a business one.

Why recovery is so hard

Stolen crypto can in theory be traced on public blockchains, but tracing is not the same as recovering. North Korean hackers move funds rapidly through many wallets, swap them across different tokens and blockchains, and use mixing services and over the counter brokers to convert them into usable money. By the time investigators identify a path, much of the value has often been laundered.

Freezes work only when stolen funds pass through cooperative exchanges or stablecoin issuers that can block addresses. The 1.1 million dollars frozen in the Bitget case shows how little typically gets caught. Speed is everything, and attackers are usually faster.

This is why prevention matters far more than recovery. Exchanges must protect their hot wallets, private keys and internal systems against attackers who are patient, well resourced and highly skilled.

What it means for exchanges and users

For crypto exchanges, the Bitget hack is another reminder that security failures can cost hundreds of millions of dollars in an instant. Exchanges that hold large amounts of customer funds are prime targets, and North Korean groups often use social engineering, fake job offers and compromised software to get inside.

The practical lessons are clear:

• Keep most customer funds in cold storage, away from internet connected systems.
• Protect employees against social engineering, a favourite North Korean technique.
• Maintain reserves or insurance that can cover losses without harming customers.
• Work with analytics firms and other exchanges to freeze stolen funds quickly.

For users, the safest approach is to use exchanges with strong security records and transparent reserves, and to consider holding long term assets in wallets they control. But self custody brings its own risks, as recent cases of tampered hardware wallets sold through resellers in Southeast Asia have shown.

We covered that case in our report on tampered Ledger wallets sold through a Southeast Asian reseller, a reminder that attackers target every link in the chain.

Asia's exposure

Asia is at the centre of the crypto economy, with many of the world's largest exchanges serving users across the region. That makes Asian platforms and users frequent targets. South Korea, Japan and Southeast Asian countries have all seen major incidents, and regulators across the region have tightened security and custody requirements in response.

Regulators are likely to respond to the Bitget case with further scrutiny of how exchanges protect customer assets. Licensing regimes in Singapore, Hong Kong, Japan and elsewhere already require strict custody controls, and incidents like this strengthen the case for applying similar standards to offshore platforms serving Asian users.

There is also a geopolitical dimension. Governments in the region are increasingly treating crypto theft by North Korea as a sanctions and security issue, cooperating with the United States and each other to track and disrupt laundering networks.

A billion dollar warning

North Korea's crypto thefts passing 1 billion dollars in 2026 is a stark warning for the industry. A sanctioned state has built one of the most effective hacking operations in the world, and it is turning the security gaps of crypto platforms into funding for its regime.

The Bitget hack shows how quickly that money disappears and how little can be recovered. For exchanges, regulators and users, the only real defence is to make attacks harder to succeed in the first place, because once the funds are gone, they rarely come back.

The Bitget hack and North Korea's billion dollar year show that crypto security is now a frontline in a geopolitical contest. A sanctioned state is systematically draining exchanges, and recovery rates are close to zero. The industry's credibility depends on making those attacks fail, through stronger custody, better staff protection and faster cooperation, because every successful theft funds a regime and weakens trust in digital assets.