AI Speeds Up Tracing of $387 Million Bitget Exploit Linked to North Korea

A massive security breach at cryptocurrency exchange Bitget on Sept. 24, 2026, resulted in the theft of hundreds of millions of dollars, triggering an intense, AI-assisted tracing effort by blockchain analytics firm Chainalysis ¹. The exploit, which targeted Bitget's hot and warm wallets, represents the largest cryptocurrency theft of 2026 by value ⁴.

While early on-chain estimates placed the loss between $170 million and $190 million by looking only at Ethereum Virtual Machine (EVM) chains, subsequent data revealed a much larger footprint ⁴. According to Chainalysis, the attackers made off with $387 million ¹, while Bitget and TRM Labs identified approximately $351.6 million in losses after accounting for outflows across the XRP Ledger and TRON ⁴. The incident has pushed the total value of cryptocurrency stolen by North Korean actors in 2026 past the $1 billion mark ¹.

The Anatomy of the Exploit

Unlike traditional hacks that rely on compromised private keys, the Bitget exploit targeted the exchange's transaction authorization infrastructure ⁴. According to Bitget CEO Gracy Chen, the attacker gained access to a backend system connected to the exchange's wallet infrastructure ⁴. The attacker then spoofed transaction data, manipulating what the authorization systems saw and tricking the exchange's withdrawal controls into approving the transfers ⁴. Bitget confirmed that its private keys were not stolen and its cold wallets remained unaffected ⁴.

This attack methodology closely mirrors the February 2025 Bybit exploit, where attackers similarly manipulated the authorization interface to trick signers into approving a transfer ⁴. In the first three hours after the Bitget breach, $387 million left the exchange across 23 transfers, landing on four primary blockchains: Ethereum ($ETH) (49.7%), XRP ($XRP) (40.8%), Zcash ($ZEC) (7.6%), and TRON ($TRX) (1.8%) ¹.

Once the funds left Bitget, the attackers executed a rapid fragmentation strategy ⁴. On Ethereum, the stolen assets were quickly split among new wallets, many holding round amounts of roughly 10,000 ETH ⁴. On the XRP Ledger, the funds passed through smaller relay accounts before arriving in separate wallets holding round amounts of 20 million XRP ⁴.

Accelerating the Chase with AI

To keep pace with the attackers' automated laundering techniques, Chainalysis deployed its in-house AI platform to build custom automation tools for its investigators ¹. This agentic platform allowed analysts to interrogate data sources and construct custom solutions tailored to the specific flow of funds ¹.

According to Chainalysis, the AI-driven tools compressed more than 20 hours of manual cross-chain bridge reconciliation into under 10 minutes ¹. This speed allowed investigators to quickly match deposits to corresponding payouts across decentralized protocols, bridging the gap between disparate blockchains ¹. Within minutes of identifying the destination addresses, Chainalysis pushed live labels to its data platform to alert compliance teams and law enforcement agencies ¹.

Human investigators remained central to the operation, defining the logic, reviewing the AI's outputs, and directing the overall tracing strategy ¹. The automation operated on top of Chainalysis's decade-long database of cross-chain attribution data, allowing investigators to link transactions that would otherwise appear unrelated ¹.

The Laundering Trail and the DPRK Connection

While TRM Labs has not definitively attributed the attack, Bitget's preliminary investigation linked the IP addresses used in the exploit to VPN services associated with a North Korean hacking group ⁴. Furthermore, on-chain tracing has revealed multiple overlaps with wallets used to launder previous North Korean hacks, including the Bybit breach and the AFX Bridge exploit ⁴. These links run through a specific laundering network that has not been observed working with any other cybercriminal group ⁴.

To obscure the trail, the attackers pushed the stolen XRP through a cross-chain liquidity protocol, taking Bitcoin ($BTC) out on the other side without needing an intermediary account ¹. Other portions of the stolen funds on BNB Chain and Ethereum were swapped through THORChain and split across Bitcoin addresses using peel chains ⁴. Stolen TRX was swapped for $USDT on SunSwap, moved to Ethereum, and routed through THORChain to be converted into Bitcoin ⁴.

This highly structured laundering pattern is characteristic of the Democratic People's Republic of Korea (DPRK) ². Historically, North Korean hackers structure on-chain payments in smaller tranches, with over 60% of their laundering volume concentrated below a $500,000 transfer value ². They also show a strong preference for cross-chain bridges, mixing services, and Chinese-language money movement and guarantee networks ².

Implications for Exchange Security

The Bitget exploit highlights a growing vulnerability for centralized exchanges: the susceptibility of backend authorization systems to data manipulation ⁴. As exchanges implement robust cold-storage solutions to protect private keys, highly sophisticated threat actors are shifting their focus toward the software and systems that control withdrawal approvals ², ⁴.

For Bitget, the financial blow was mitigated by its $464 million User Protection Fund, which the exchange stated would cover the entire loss ⁴. However, the incident underscores the escalating scale of individual breaches ². In 2025, the ratio between the largest hack and the median of all incidents crossed the 1,000x threshold for the first time, concentrating losses heavily among a few catastrophic events ².

What to Watch

• Movement of Dormant Funds: As of late September, large portions of the stolen ETH and XRP remained stationary in the initial round-number holding wallets ⁴. Observers are monitoring these addresses to see when and how they enter the next stage of the laundering cycle ⁴.
• Bitget's Incident Report: The exchange has promised a detailed incident report, which is expected to clarify how the backend system was compromised and provide further technical evidence regarding North Korean attribution ⁴.
• Chainalysis Product Reveal: Chainalysis has announced it will showcase the next generation of its AI-assisted investigative capabilities during a public presentation on Nov. 19, 2026 ¹.