Chainalysis has attributed the $387 million theft from crypto exchange Bitget to North Korea-linked actors, saying the incident pushed the total value of cryptocurrency stolen by groups tied to Pyongyang in 2026 above $1 billion. The assessment adds to earlier conclusions from Bitget chief executive Gracy Chen and blockchain analytics firm Elliptic.
Funds moved across four networks
The breach took place on September 24. Chainalysis said it worked with Bitget and law enforcement to follow the stolen assets as they moved between blockchains.
According to Decrypt, the attackers transferred the full $387 million in 23 transactions during the first three hours. The funds were distributed across four networks:
- Ethereum: 49.7%
- XRP: 40.8%
- Zcash: 7.6%
- Tron: 1.8%
The attackers then used cross-chain liquidity and messaging protocols, instant swaps and laundering services in an effort to make the money harder to track. Chainalysis said the movement of the stolen assets continued to play out publicly as blockchain observers followed the transactions.
The XRP portion received particular attention. Instead of sending those assets directly to an exchange, the attackers used a cross-chain liquidity protocol to receive Bitcoin on the other side. Tens of millions of dollars moved through that route over about a day and a half before reaching Bitcoin addresses controlled by the attackers. Those addresses are now being monitored.
AI accelerated the investigation
Chainalysis said it developed in-house artificial-intelligence tools to speed up the tracing process. The company estimated that its custom automation reduced more than 20 hours of manual work reconciling activity across bridges to less than 10 minutes.
The firm emphasized that the technology supported investigators rather than replacing them. Human analysts continued to direct the investigation and interpret the results.
The laundering efforts also included the use of Zcash’s shielded pool, which is designed to conceal transaction details. Meanwhile, services took different approaches to transactions connected to the hacker. Near Intents rejected more than $50 million in related swaps, although the service was hacked several days later. Thorchain continued processing swaps.
Circle and Tether froze approximately $318,000 in stablecoins linked to the stolen funds.
Wider crypto market picture
Moneyiar market data at 09:44 on October 5, 2026, showed Cronos (CRO) at $0.0694011153, up 0.93% over 24 hours and 9.35% over seven days. OriginTrail (TRAC) was $0.4399897473, down 1.87% in 24 hours but up 26.23% over seven days.
Four (FORM) stood at $0.2835244618, down 0.47% over 24 hours and 2.45% over seven days. Billions Network (BILL), for which Moneyiar’s latest supplied reading was recorded at 01:39 on September 21, was $0.0139971939, down 0.59% over 24 hours and up 10.04% over seven days.
Chainalysis’ attribution is not the first North Korea-related assessment of the incident. Bitget’s CEO said the attack’s patterns matched North Korean hackers, while Elliptic described a link to the Democratic People’s Republic of Korea as highly likely. Chainalysis’ report adds the firm’s transaction analysis and its estimate that the theft pushed 2026 losses attributed to North Korea-linked groups past $1 billion.
