Chainalysis AI traces North Korea's $387 million Bitget hack in minutes

North Korea's crypto theft total for 2026 has crossed $1 billion. The firm trying to track the money down had to build its own AI to keep pace with the thieves.

At 18:31 UTC on September 24, Bitget's security team caught unauthorized transfers draining cryptoassets including ETH, XRP, BNB, AVAX, USDT and USDC from the exchange's hot and warm wallets. The initial damage looked like $351.6 million. Within days, after investigators found more stolen assets sitting on Zcash and Tron, that number climbed to $387.5 million. Bitget CEO Gracy Chen said on a livestream that the attack was consistent with techniques used by DPRK-linked hacking groups, pointing to IP addresses tied to VPN infrastructure the same actors have used before.

The thieves didn't linger. According to Chainalysis, the full haul moved across 23 separate transfers within three hours of the breach, landing on four different blockchains: Ethereum took the largest cut at 49.7%, XRP carried 40.8%, Zcash held 7.6% and Tron took the remaining 1.8%. Rather than funnel the XRP toward a centralized exchange where it might get frozen, the attackers ran it through a cross-chain liquidity protocol and came out the other side holding Bitcoin. Chen described the breach itself as a backend compromise inside Bitget's wallet infrastructure, used to spoof transaction data, not a theft of private keys.

Here's the part that actually makes this story different from the last twenty DPRK exchange hacks. Chasing stolen funds across four chains in near real time used to mean an analyst manually reconciling bridge transactions, matching a deposit on one network to a payout on another, one pair at a time. Chainalysis says that kind of work has historically taken more than 20 hours per incident. For the Bitget case, the firm built custom automation that compressed it to under 10 minutes.

Chainalysis was careful to say its investigators still defined the matching logic, reviewed every output and directed the investigation themselves. The AI didn't decide who stole the money. It did the repetitive cross-chain legwork, pairing deposits with payouts across Ethereum, XRP, Zcash and Tron fast enough to keep the trail warm while the thieves were still moving. That distinction matters, because North Korean operators have gotten better at laundering stolen crypto faster than investigators can follow it. Shaving 20 hours down to minutes is the difference between tracing funds while they're still sitting in an identifiable wallet and tracing them after they've already been swapped through three more hops.

Chainalysis's attribution didn't stand alone. Elliptic separately confirmed the DPRK pattern match and said the Bitget attack pushed its own running tally of suspected North Korean crypto theft in 2026 past $1 billion, spanning more than 51 incidents this year alone. In 2025, Elliptic had tracked more than $2 billion stolen by DPRK-linked actors across the industry. Two firms, working independently, landed on the same country.

None of this is new behavior from Pyongyang. What's shifted is the tempo. North Korean state hackers have spent years refining a playbook: breach a backend or a hot wallet, move stolen funds across as many chains as possible before anyone can act, and lean on privacy coins and cross-chain bridges to break the trail. Zcash's presence in this haul, small as it is at 7.6%, fits that pattern exactly. What Bitget's incident shows is that the forensics side is now racing to match that speed with automation of its own, rather than simply publishing a slower postmortem weeks later.

Frankly, the more interesting number here isn't the $387.5 million. It's the under-10-minutes. If state- hacking groups are moving stolen funds across four blockchains within three hours, then the investigators chasing them either show up with tools that work at the same speed, or they show up too late to matter.

Also read: Cronos community votes 99.78% to burn 228 million CRO and fund buybacks • Fed's Kevin Warsh faces a hold after a hike and a shock jobs miss • SEC clears triple-leveraged Bitcoin, Ether and metals ETFs for listing

This article is posted in Crypto News , check it out for more related stories.

Almost there. Sign in and your posts straight away.