Chainalysis has attributed the $387 million Bitget exchange hack of Sept. 24 to North Korea-linked actors, pushing Pyongyang's documented crypto theft total for 2026 past $1 billion, the blockchain analytics firm said in a Wednesday report.

The firm said it has worked alongside Bitget and law enforcement since the breach to trace the stolen assets across multiple networks. The attribution aligns Bitget's own assessment with those of independent researchers.

"The attack's patterns matched North Korean hackers," Bitget CEO Gracy Chen said shortly after the incident. Blockchain analytics firm Elliptic separately called a DPRK link "highly likely."

How did the funds move in the first three hours?

Within three hours of the breach, the attackers executed 23 outbound transfers distributing the $387 million across four blockchains:

• Ethereum: 49.7%
• XRP: 40.8%
• Zcash: 7.6%
• Tron: 1.8%

From there, the funds passed through cross-chain liquidity and messaging protocols, instant swaps and laundering services designed to obscure provenance, Chainalysis reported.

What happened to the stolen XRP?

The XRP tranche drew particular attention from investigators. Rather than depositing it on a centralized exchange, the attackers routed it through a cross-chain liquidity protocol and redeemed Bitcoin on the other side. Tens of millions of dollars traveled that path over roughly 36 hours before settling in attacker-controlled Bitcoin addresses now under Chainalysis surveillance.

How did AI change the tracing workflow?

Chainalysis said it deployed in-house AI tooling to accelerate the investigation, building custom automation that compressed what it estimated as more than 20 hours of manual bridge reconciliation into under 10 minutes. The firm framed the technology as an accelerator for human investigators rather than a replacement.

How have swap services and stablecoin issuers responded?

The hacker's laundering has played out in public. Cross-chain swap service Near Intents rejected more than $50 million in swaps tied to the attacker — only to be hacked itself days later. Thorchain, by contrast, continued processing transactions associated with the stolen funds.

The attackers also began parking assets in Zcash's shielded pool to deepen the opacity. Stablecoin issuers Circle and Tether froze roughly $318,000 combined in USDC and USDT linked to the address cluster.

What does the broader 2026 picture look like?

The $387 million Bitget theft now sits inside a $1 billion-plus annual total for North Korea-linked actors, a figure that includes earlier heists tracked by Chainalysis and peer firms. The case underscores two operational pressures on the industry: the speed at which DPRK-affiliated operators can move nine-figure sums across heterogeneous chains, and the uneven posture of decentralized infrastructure providers when confronted with illicit flow.

Chainalysis said it continues to share updated address clusters with compliance teams and law enforcement, and the Bitget investigation remains active as tracing firms monitor residual balances across the implicated networks.