Blockchain analytics firm Chainalysis has attributed the September 24 hack of the Bitget exchange to actors linked to North Korea. The incident involved the theft of $387 million, which contributed to the total value of cryptocurrency stolen by North Korea-linked groups in 2026 exceeding $1 billion.
During the initial three hours following the breach, the stolen funds were moved across 23 transfers to four different networks. Ethereum accounted for 49.7% of the assets, followed by XRP at 40.8%, Zcash at 7.6%, and Tron at 1.8%. The attackers subsequently utilized cross-chain liquidity protocols, instant swaps, and laundering services to obscure the transaction trail.
Chainalysis reported that it employed custom in-house AI automation to track the funds. This technology reduced the time required for manual bridge reconciliation from an estimated 20 hours to less than 10 minutes. The firm emphasized that the AI served to accelerate the work of human investigators rather than replacing them.
The investigation involved collaboration between Chainalysis, Bitget, and law enforcement agencies. Bitget CEO Gracy Chen previously noted that the attack patterns were consistent with North Korean hacking activity, a conclusion also supported by the blockchain analytics firm Elliptic.
