Issuers and protocols have frozen about 0.2% of the $387 million taken from Bitget

Going by Chainalysis's own wording, the Bitget theft is between about 28% and 39% of everything North Korea-linked groups have stolen in crypto this year ^[1]. A $387.5 million theft ^[2] that pushed the 2026 total past $1 billion ^[1] means the year's earlier thefts added up to between roughly $612.5 million and $1 billion ^[1]. Earlier assessments had already pointed the same way. Bitget CEO Gracy Chen cited matching IP addresses and familiar on-chain patterns, and TRM Labs tied the breach to earlier DPRK incidents ^[15]. Elliptic called the link "highly likely" ^[16].

Chainalysis estimated that manual bridge reconciliation would take more than 20 hours. That is more than six times the three-hour window in which the money scattered ^[2]. The firm stressed that humans still directed the work ^[9]. On the first move, then, tracing by hand could not keep up. The XRP leg was slower. Tens of millions of dollars took roughly a day and a half to pass through a cross-chain liquidity protocol and come out as Bitcoin in attacker-controlled addresses ^[7]. A manual reconciliation of 20-odd hours would have fit inside that window ^[3].

Tracing finds the coins, but recovering them needs a venue that will hold them. Circle and Tether froze roughly $318,000 in stablecoins ^[10], about 0.08% of the loss ^[4]. Crypto Briefing puts the share frozen by issuers or protocols at about 0.2% ^[13], or roughly $775,000 ^[5]. The two reports do not itemise the difference. The swaps Near Intents rejected ^[11] came to more than 60 times that frozen total ^[9], and a rejected swap leaves the coins with the sender.

So the bill sits with Bitget. The exchange has pledged that its User Protection Fund, which it says holds more than $464 million, will cover the loss in full, and that customer balances will not be affected ^[14]. A $387.5 million payout uses about 84% of that stated floor and leaves at least $76.5 million, roughly a sixth ^[6]. The upward revision of the loss estimate added $35.9 million, about 10%, to the bill ^[7]. Bitget is choosing not to push any of the loss onto customers. Crypto Briefing wrote that the money spent replenishing users "is money the exchange is unlikely to see again" ^[17].

There are two places where that could change. The Zcash leg, about $29 million on Chainalysis's split ^[8], is where the attacker began hiding funds in the shielded pool ^[12]. The watched Bitcoin addresses are the other. I'd expect the frozen share to stay under 1% of the loss, or about $3.9 million ^[10]. That view is wrong if the Bitcoin addresses now under watch, which took in tens of millions of dollars of converted XRP ^[7], send coins to a venue that freezes them.