Chainalysis attributed the $387 million Bitget hot-wallet theft to North Korean actors in an October 1 report, tracing the stolen funds across four blockchains and pushing the value of crypto stolen by DPRK-linked groups in 2026 past $1 billion, according to the blockchain intelligence firm. Bitget paused withdrawals after the breach and has been restoring services in phases since late September. The findings offer the most detailed public account yet of how the funds left the exchange on September 24.
How the stolen funds moved
Within three hours of the exploit, $387 million left Bitget in 23 transfers and landed on four chains, Chainalysis said: Ethereum received 49.7% of the funds, XRP 40.8%, Zcash 7.6% and Tron 1.8%. Rather than routing the stolen XRP to an exchange, the attackers pushed tens of millions of dollars through a cross-chain liquidity protocol and pulled Bitcoin out the other side, a laundering path Chainalysis reconstructed over roughly a day and a half by matching deposits to their corresponding payouts. The firm said hundreds of transfers have followed the initial exodus, with funds repeatedly shuttled between networks such as Ethereum and Bitcoin through bridges, mixers and decentralized exchanges. Investigators drew on cross-chain attribution data built over more than a decade to match deposits and payouts across different protocols.
AI-assisted tracing
Chainalysis said investigators built custom automation on its agentic platform to interrogate its own data and accelerate complex cross-chain tracing, compressing more than 20 hours of manual bridge reconciliation into under 10 minutes in one instance. The firm stressed the tooling did not replace human judgment: investigators still defined the logic, reviewed the outputs and directed the investigation. A round-the-clock war room kept Bitget and law enforcement partners updated as investigators followed the money, and within minutes of identifying the stolen funds, Chainalysis said, labels flagging them were live in its data platform for compliance teams and law enforcement.
A record year for North Korean theft
The attribution lifts the total crypto stolen by North Korea-linked actors in 2026 above $1 billion, according to Chainalysis. Bitget confirmed the hot-wallet breach in late September and subsequently began resuming withdrawals in phases. Chainalysis said it will keep monitoring the stolen funds, labeling newly identified addresses and working with exchanges, issuers and law enforcement partners, and that the intelligence can support efforts to identify, freeze or block the stolen assets as the trail is extended in the coming weeks.
