Blockchain analytics firm Chainalysis has traced last month’s $387 million Bitget exchange hack back to North Korea, pushing Pyongyang’s 2026 crypto theft total past $1 billion. The firm published its findings Wednesday, saying it used in-house AI to speed up the investigation.
Within three hours of the Sept. 24 attack, $387 million left Bitget across 23 transfers, landing on four networks:
- Ethereum, taking nearly half at 49.7%
- XRP, taking 40.8%
- Zcash, taking 7.6%
- Tron, taking 1.8%
How the Funds Moved
The attackers directed the stolen funds through cross-chain liquidity and messaging protocols, instant swaps, and laundering services in order to obscure the trail. The stolen XRP stood out from the rest. Instead of sending it to an exchange, they passed it through a cross-chain liquidity protocol and extracted Bitcoin at the other end. Tens of millions of dollars moved that way over roughly a day and a half before landing in attacker-controlled Bitcoin addresses now under watch.
The AI Accelerator
The company’s own AI tools were credited with keeping pace, according to Chainalysis, which built custom automation that compressed what it estimated as more than 20 hours of manual bridge reconciliation into under 10 minutes. The firm emphasized that the technology accelerated its investigators rather than replacing them, with humans still directing the work.
Earlier Assessments
The attribution lines up with prior judgments. Elliptic flagged a connection to North Korea, and Bitget CEO Gracy Chen pointed to the attack’s resemblance to DPRK-linked hackers, calling it “highly likely.”.
What Happened to the XRP
Funds started getting hidden inside Zcash’s protected storage area by the person behind the attack. The reaction from exchange services that trade between chains was not uniform.
- Near Intents rejected more than $50 million in swaps tied to the hacker, only to be hacked itself days later
- Thorchain kept processing
Circle and Tether froze roughly $318,000 in stablecoins.
The Money Trail
The laundered XRP trail shows obfuscation tactics similar to those seen in previous breaches. Pyongyang’s 2026 crypto theft total is now past $1 billion.
Why This Matters
Bitget and law enforcement collaborated with Chainalysis on tracing the funds across several blockchains following the attack. The firm’s AI tools cut what would otherwise take investigators days down to minutes, though human oversight remained throughout.
The Public Watch
The hacker’s crypto laundering has played out in public, with eagle-eyed sleuths tracking every move. The attacker began hiding funds in Zcash’s shielded pool.
The Pattern Holds
Gracy Chen’s earlier warning about North Korean hackers now stands confirmed by Chainalysis. Elliptic’s assessment of a “highly likely” DPRK link also holds up against the firm’s tracing.
The sequence is recognizable: the assailants shifted the funds across several networks and concealed the route through cross-chain liquidity and money-washing services. The amount taken has now surpassed $1 billion, with the figure derived from 2026.
Source material: “Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea,” Decrypt.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.