Chainalysis says North Korea-linked attackers stole $387 million from Bitget on September 24, then moved the assets across several networks and services. The blockchain-analysis company published its account on October 1 after working with the exchange and law-enforcement partners.
The attribution and dollar figure come from Chainalysis, which is participating in the investigation. Its report offers detailed tracing evidence, but it is not a court finding or a public statement from a government agency. That distinction matters when describing both who was responsible and how much was taken.
The first three hours spread the trail across four chains
According to the company, 23 transfers carried the $387 million out of Bitget during the first three hours. Ethereum received 49.7% of the value, XRP 40.8%, Zcash 7.6% and Tron 1.8%. The percentages total 99.9% because the published figures are rounded.
The XRP portion did not simply move to a centralized exchange. Chainalysis says the attackers sent tens of millions of dollars through a cross-chain liquidity protocol and received Bitcoin on the other side. Investigators matched deposits with payouts, then followed later transactions through bridges, mixers and decentralized exchanges to Bitcoin addresses they identified as attacker-controlled.
This is the practical difficulty in cross-chain investigations: a transfer may stop on one ledger and continue on another with a different asset. Each leg can still leave records, but reconstructing the sequence requires matching amounts, timing and protocol activity rather than following one address on one chain.
Automation reduced reconciliation time, not the need for judgment
Chainalysis also described how its investigators used in-house AI tools. The team built custom automations to query its data and reconcile cross-chain activity. In one example, the company estimates that work requiring more than 20 hours of manual bridge reconciliation took less than 10 minutes.
That is a vendor-reported result from this investigation, not an independent benchmark. Chainalysis says people still defined the tracing logic, reviewed the output and directed the work. The useful point is therefore narrower than “AI solved the case”: automation accelerated a specific matching task inside an investigation led by analysts.
The firm says labels identifying stolen funds went live in its data platform within minutes of identification. Such labels can help compliance teams and law enforcement follow the assets, but a label by itself does not freeze or recover them. Chainalysis said it would continue monitoring destination addresses and sharing intelligence with exchanges, issuers and law-enforcement partners.
The wider total is also an attribution
The Bitget incident pushed the value Chainalysis attributes to North Korea-linked crypto theft in 2026 above $1 billion. That annual total depends on the company’s attribution methods and should be reported as its assessment, not as a universally settled count.
For exchanges and investigators, the episode shows why incident response must work across chains. Fast withdrawals, swaps and bridges can fragment a trail within hours, while effective tracing depends on preserving transaction records, coordinating with counterparties and separating automated leads from conclusions reviewed by investigators.
Adapted from Chainalysis Attributes $387M Bitget Hack to North Korea as 2026 Thefts Top $1B.