Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea
Chainalysis attributed the $387 million Bitget exchange hack to North Korea-linked actors, reinforcing a broader consensus that Pyongyang was behind one of the year’s biggest crypto thefts. The theft, on Sept. 24, pushed North Korea-linked crypto losses in 2026 past $1 billion. Funds moved fast: within three hours, the attackers sent the stolen assets through 23 transfers across Ethereum, XRP, Zcash, and Tron. They then used cross-chain liquidity and messaging protocols, instant swaps, and laundering services to obscure the trail. A large share of the XRP was routed through a bridge and converted into Bitcoin, ending up in attacker-controlled BTC addresses. Chainalysis said its in-house AI helped compress more than 20 hours of manual tracing into under 10 minutes, though investigators still directed the work. The attribution matches earlier views from Bitget and Elliptic. Some funds were publicly tracked, with Circle and Tether freezing about $318,000 in stablecoins.
