Chainalysis says AI helped trace $387 million Bitget hack to North Korea

Chainalysis attributed last month's $387 million Bitget exchange hack to actors tied to North Korea in a report published Wednesday. Chainalysis said the September 24 breach pushed the total value of crypto stolen by North Korea-linked groups in 2026 past $1 billion. Chainalysis said it had worked with Bitget and law enforcement to trace the funds across multiple blockchains since the attack.

Chainalysis said $387 million left Bitget across 23 transfers in the first three hours and reached four blockchain networks. Chainalysis put Ethereum's share at 49.7% of the transferred funds. Chainalysis put XRP's share at 40.8%. Chainalysis put Zcash's share at 7.6%. Chainalysis put Tron's share at 1.8%. The attackers then used cross-chain liquidity and messaging protocols, instant swaps and laundering services to obscure the funds' trail.

The attackers routed stolen XRP through a cross-chain liquidity protocol to obtain Bitcoin rather than sending the XRP to an exchange. Tens of millions of dollars moved through that route over roughly a day and a half before reaching attacker-controlled Bitcoin addresses. Those Bitcoin addresses are now being monitored.

Chainalysis said its custom in-house AI automation reduced an estimated more than 20 hours of manual bridge reconciliation to under 10 minutes. Chainalysis stressed that the technology accelerated investigators' work rather than replacing investigators. Chainalysis said humans continued to direct the work. Bitget CEO Gracy Chen previously said the attack's patterns matched North Korean hackers. Blockchain analytics firm Elliptic called a North Korea link highly likely.

The attacker's laundering has unfolded publicly, with cryptocurrency investigators tracking the funds' movements. The attacker began hiding funds in Zcash's shielded pool. Near Intents rejected more than $50 million in swaps tied to the hacker. Near Intents was itself hacked days later. However, Thorchain continued processing swaps. Circle and Tether froze roughly $318,000 in stablecoins.