AI Traces Bitget Hack to North Korea, Chainalysis Confirms

Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea

Blockchain analytics firm Chainalysis says it has attributed last month’s $387 million hack of crypto exchange Bitget to DPRK-linked actors, adding support to a growing consensus that North Korea was behind one of the largest crypto thefts of the year.

Chainalysis said it has been working with Bitget and law enforcement partners since the Sept. 24, 2026 breach to trace the stolen funds as they moved across multiple blockchains and protocols.

According to Chainalysis, the attackers moved quickly. Within the first three hours, the stolen funds left Bitget in 23 transfers and spread across four networks: Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%). Chainalysis said the attackers then used cross-chain liquidity and messaging protocols, instant swaps, and laundering services in an effort to obscure the trail.

A central part of Chainalysis’ account was how it used in-house AI to speed up the investigation. The firm said it built custom automation to reconcile activity across bridges—work it estimated would typically require more than 20 hours of manual effort—reducing that portion of tracing time to under 10 minutes.

Chainalysis emphasized that the technology accelerated investigators rather than replacing them. Under the process it described, analysts set the matching rules, reviewed outputs, and decided which leads to pursue, while the AI helped connect cross-chain deposits and payouts faster than traditional workflows.

The firm framed the speed improvements as significant for time-sensitive response efforts, where exchanges, token issuers, and law enforcement often have a limited window to identify funds as they move and potentially act on recoveries.

Chainalysis also said the Bitget incident pushed North Korea’s total crypto theft in 2026 past $1 billion, underscoring the scale of DPRK-linked activity and the increasing use of cross-chain techniques to disperse and launder stolen assets.

• Incident: $387 million stolen from Bitget on Sept. 24, 2026
• Initial flow: 23 transfers across Ethereum, XRP, Zcash, and Tron within three hours
• Tracing method: in-house AI used to automate bridge reconciliation, compressing 20+ hours of work to under 10 minutes
• Attribution: Chainalysis attributes the hack to DPRK-linked actors