Chainalysis attributes $387 million Bitget hack to North Korea-linked actors

Blockchain analytics firm Chainalysis has pinned last month's $387 million Bitget exchange hack on North Korea, adding its weight to a growing consensus that Pyongyang's hackers were behind one of the year's largest crypto thefts.

In a report published Wednesday, Chainalysis attributed the Sept. 24 breach to actors tied to the Democratic People's Republic of Korea, saying the heist pushed the total value of crypto stolen by North Korea-linked groups in 2026 past $1 billion.

The firm said it had been working with Bitget and law enforcement to trace the funds across multiple blockchains since the attack.

Chainalysis laid out how quickly the money moved. In the first three hours, $387 million left Bitget across 23 transfers and landed on four networks: Ethereum, which took nearly half at 49.7%, followed by XRP at 40.8%, Zcash at 7.6% and Tron at 1.8%.

From there, the attackers ran the funds through cross-chain liquidity and messaging protocols, instant swaps, and laundering services to obscure the trail.

The stolen XRP drew particular attention. Rather than routing it to an exchange, the attackers pushed it through a cross-chain liquidity protocol and pulled Bitcoin out the other side, with tens of millions of dollars moving that way over roughly a day and a half before reaching attacker-controlled Bitcoin addresses now under watch.

Notably, Chainalysis said it leaned on in-house AI to keep pace, building custom automation that compressed what it estimated as more than 20 hours of manual bridge reconciliation into under 10 minutes.

The firm stressed the technology accelerated its investigators rather than replacing them, with humans still directing the work.

The attribution echoes earlier assessments. Bitget CEO Gracy Chen said the attack's patterns matched North Korean hackers, and the blockchain analytics firm Elliptic called a DPRK link "highly likely."

The hacker’s crypto laundering has played out in public, with eagle-eyed sleuths tracking every move. The attacker began hiding funds in Zcash's shielded pool, while swap services split in their response: Near Intents rejected more than $50 million in swaps tied to the hacker, only to be hacked itself days later, while Thorchain kept processing.