North Korea Just Crossed $1B in Crypto Theft, and the $387M Bitget Hack Is How They Did It

North Korea Just Crossed $1B in Crypto Theft, and the $387M Bitget Hack Is How They Did It

North Korean state-backed hackers have now stolen over $1 billion in crypto in 2025 alone, and the $387 million Bitget exploit just pushed them past that threshold.

Blockchain analytics firm Chainalysis has formally attributed the Bitget theft to DPRK-linked actors, confirming what many in the security community had suspected for weeks. The scale of this operation is not a blip. It is a pattern, and it is accelerating.

How They Moved the Money

The attackers did not simply drain the funds and vanish. According to Chainalysis, the hackers executed a cross-chain swap, converting the stolen XRP directly into Bitcoin before moving it off the radar entirely. The funds were deliberately kept away from centralized exchanges, making them significantly harder to freeze or trace through traditional compliance channels.

This is sophisticated operational security. Swapping XRP to Bitcoin reduces exposure to Ripple's increasingly active freeze mechanisms, while Bitcoin's deeper liquidity and broader mixer infrastructure gives the attackers more runway before funds become unspendable.

The Bigger Picture Most People Are Missing

The $1 billion milestone matters beyond the headline number. It signals that DPRK-linked groups have industrialized crypto theft at a scale that dwarfs most state-sponsored cybercrime programs in history. These are not opportunistic hackers. They are a well-funded, state-directed operation that treats crypto exchange vulnerabilities as a national revenue stream.

Projects including Drift and KelpDAO are also reportedly entangled in the fallout, suggesting the blast radius from this single exploit is still expanding across the DeFi ecosystem.

What This Means for the Market Right Now

Large stolen Bitcoin hoards held off-exchange create latent sell pressure. When DPRK-linked wallets eventually move funds through mixers and OTC desks, it rarely shows up as clean on-chain signals until after the price impact lands. Traders who ignored the Lazarus Group's Bybit-linked movements earlier this year watched Bitcoin absorb unexpected supply without understanding why.

Do not make the same mistake twice.

Watch for: Unusual large OTC flows in Bitcoin over the coming weeks. Monitor Chainalysis and on-chain alert services for wallet cluster activity tied to this exploit. If you hold XRP, note that stolen XRP was converted out rather than held, which reflects attacker confidence in Bitcoin's laundering infrastructure over Ripple's ecosystem.

The $1 billion number is a warning. The method they used to get there is the actual threat.