Skip to content
$BTC$84,781+1.6%$ETH$2,704+0.8%$SOL$118.41+0.4%$XRP$1.49+0.3%$TON$1.56+4.7%MCap$2.91T+2.4%BTC.D58.3%Fear&Greed72 GreedGas0.16 gwei·5 sat/vBNews mood22% bullish
Basis Desk
Security & Hacks · 1 min read

Chainalysis Traces $387 Million Bitget Heist Linked to North Korea

Investigators deployed in-house AI automations to follow stolen assets across four blockchains, pushing North Korea's 2026 theft tally past $1 billion.

Editorial oversight: Julian Mercer, Chief Editor
Bearish
$BTC $84,781 +1.6% $ETH $2,704 +0.8% $XRP $1.49 +0.3% $ZEC $1,333 −7.1% $TRX $0.3342 −1.1%

Key points

  • North Korean-attributed attackers stole $387 million from exchange Bitget on Sept. 24 across 23 transactions on four chains.
  • The breach pushed total cryptocurrency stolen by DPRK-linked entities in 2026 above $1 billion.
  • Chainalysis deployed proprietary AI tools to compress 20 hours of bridge reconciliation into under 10 minutes.

North Korean cyber actors stole $387 million from cryptocurrency exchange Bitget on Sept. 24, 2026, according to blockchain analytics firm Chainalysis 1. The incident, previously reported amid an evolving tally of the Bitget hot wallet breach, pushes the total cryptocurrency stolen by groups attributed to the Democratic People's Republic of Korea (DPRK) past $1 billion in 2026 1.

In the first three hours following the intrusion, the stolen capital departed Bitget via 23 separate transactions across four networks: Ethereum accounted for 49.7%, XRP represented 40.8%, Zcash made up 7.6%, and Tron captured 1.8% 1. To obscure the proceeds, the perpetrators leveraged cross-chain liquidity and messaging protocols, instant swaps, and specialized laundering platforms 1. Notably, tens of millions of dollars in stolen XRP were converted into $BTC via cross-chain protocols over roughly 36 hours, moving through decentralized venues before arriving at monitored attacker-controlled addresses 1.

AI-Accelerated Cross-Chain Tracking

To counter automated laundering techniques, Chainalysis investigators utilized in-house artificial intelligence tooling to generate custom tracking automations 1. The platform compressed more than 20 hours of manual bridge reconciliation down to under 10 minutes, matching cross-chain deposits with corresponding payouts 1. Chainalysis emphasized that human analysts directed the investigation and reviewed outputs, while AI accelerated the data processing 1.

Chainalysis stated it has placed real-time labels on identified recipient addresses and will continue working alongside Bitget, asset issuers, and law enforcement agencies to intercept the assets 1. The broader digital asset market registered mild gains at the time of writing, with $ETH trading at $2,702 and Bitcoin at $84,731. Chainalysis announced it will showcase further details regarding its next-generation investigative capabilities on Nov. 19 1.

Questions this story raises

How were the stolen Bitget funds split across blockchains?
Within three hours of the attack, $387 million moved across four chains: Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%).
How did Chainalysis apply artificial intelligence to trace the hack?
Investigators used in-house AI to build custom automations that compressed over 20 hours of cross-chain bridge reconciliation work into less than 10 minutes.

Sources

  1. [1] How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget — Chainalysis Blog, October 1, 2026

Written by Basis Desk's newsroom system from the primary sources above and machine-verified against them before publication. Market figures marked "at the time of writing" come from live exchange data. Report an error: corrections@basisdesk.news · corrections policy.

Community read
How do you read this story for the assets involved? One vote a day, anonymous.
Be the first to vote
Share X Telegram Bluesky Markdown

The Daily Brief, in your inbox at 07:00 ET

Five stories, the numbers that moved, what to watch. Three minutes. No hype, no advice, unsubscribe in one click.

Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.