Chainalysis has attributed the $387 million theft from Bitget to DPRK-linked threat actors after tracing the stolen assets across multiple blockchain networks and protocols. The investigation shows how quickly the attackers fragmented the funds, while also highlighting how automated blockchain intelligence can help investigators reconstruct complex cross-chain transactions.
Bitget Hack Funds Spread Across 4 Networks in 3 Hours
Chainalysis said $387 million left Bitget in 23 transfers during the first three hours after the September 24 exploit. Ethereum accounted for 49.7% of the stolen funds, followed by XRP at 40.8%, while Zcash and Tron represented 7.6% and 1.8%, respectively. The distribution shows that the attackers immediately divided the assets across different networks rather than keeping the funds in a single wallet or chain.
The rapid movement created a cross-chain tracing challenge for investigators. Chainalysis said the stolen XRP was particularly significant because tens of millions of dollars were moved through a cross-chain liquidity protocol and converted into Bitcoin over roughly a day and a half.
Investigators matched deposits on one network with corresponding payouts on another, allowing them to continue following the funds after they changed blockchain.
Also Read: Chainalysis Exposes Massive $457B Taxable CARF Gap Today
Cross-Chain Liquidity Became a Key Laundering Route
Cross-chain liquidity protocols allow users to deposit one cryptocurrency and receive another asset on a different blockchain.
In this case, Chainalysis said the attackers used that functionality to move stolen XRP into Bitcoin without relying on a conventional centralized exchange. Each transaction still generated blockchain records, giving investigators data points that could be connected across networks.
Chainalysis also identified instant swaps, cross-chain messaging protocols and laundering services among the mechanisms used after the initial theft.
The investigation therefore demonstrates that blockchain transparency does not necessarily prevent rapid movement of illicit funds. Instead, the challenge for investigators is connecting transactions that are distributed across different protocols, chains and wallet addresses.
Chainalysis Used AI to Accelerate Fund Tracing
A significant additional development is Chainalysis’ use of in-house artificial intelligence during the investigation. The company said its investigators built custom automation that reduced more than 20 hours of manual bridge reconciliation to less than 10 minutes. The tools helped connect fragmented transactions and accelerate the identification of stolen-fund addresses.
Chainalysis emphasized that AI did not replace human investigators. Its specialists defined the investigation logic, reviewed automated outputs and directed the tracing process.
The approach matters because DPRK-linked actors are increasingly using sophisticated methods to move stolen cryptocurrency quickly, making the speed of detection relevant to exchanges, asset issuers and law enforcement.
DPRK Crypto Theft Surpasses $1B in 2026
Chainalysis said the Bitget theft pushes the total value of cryptocurrency stolen by DPRK-attributed actors in 2026 above $1 billion. The figure adds to a broader pattern in which North Korean-linked groups have targeted cryptocurrency platforms and subsequently moved assets through multiple blockchain ecosystems. Chainalysis said it will continue monitoring the stolen funds and labeling newly identified destination addresses.
The incident also has direct implications for exchange security and recovery efforts. Bitget said the affected amount was revised to $387.5 million after additional assets were identified, while its cold wallets remained unaffected and user account balances were not impacted.
The exchange said its Protection Fund, which held more than $464 million during the incident, would cover the financial impact, and later reported that the fund had been replenished to more than $300 million.
For the broader crypto industry, the investigation illustrates both the risks and advantages of transparent blockchains. Attackers can move assets across several networks within minutes, but those transactions can also provide investigators with a persistent trail. Chainalysis’ continuing monitoring will determine whether additional funds can be identified, frozen or recovered as the stolen assets move through the ecosystem.
Also Read: Chainalysis Challenges $94.7M ICE Contract Awarded to TRM Labs
Be the first to comment