Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea

In brief

• Chainalysis attributed the $387 million Bitget hack to North Korea-linked actors, saying it pushed Pyongyang's 2026 crypto theft total past $1 billion.
• Within three hours, the funds moved across 23 transfers onto Ethereum (49.7%), XRP (40.8%), Zcash (7.6%) and Tron (1.8%).
• The firm said it used in-house AI to accelerate tracing—compressing 20+ hours of work into minutes—echoing earlier DPRK assessments from Bitget's CEO and Elliptic.

Blockchain analytics firm Chainalysis has pinned last month's $387 million Bitget exchange hack on North Korea, adding its weight to a growing consensus that Pyongyang's hackers were behind one of the year's largest crypto thefts.

In a report published Wednesday, Chainalysis attributed the Sept. 24 breach to actors tied to the Democratic People's Republic of Korea, saying the heist pushed the total value of crypto stolen by North Korea-linked groups in 2026 past $1 billion.

The firm said it had been working with Bitget and law enforcement to trace the funds across multiple blockchains since the attack.

Chainalysis laid out how quickly the money moved. In the first three hours, $387 million left Bitget across 23 transfers and landed on four networks: Ethereum, which took nearly half at 49.7%, followed by XRP at 40.8%, Zcash at 7.6% and Tron at 1.8%.