{"slug": "chainalysis-used-ai-to-trace-the-387m-bitget-hack-back-to-north-korea", "title": "Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea", "summary": "Chainalysis attributed the $387 million Bitget exchange hack to North Korea-linked actors in a report published Wednesday, saying the Sept. 24 breach pushed Pyongyang's 2026 crypto theft total past $1 billion. Chainalysis said it used in-house AI to compress what it estimated as more than 20 hours of manual bridge reconciliation into under 10 minutes, tracing $387 million that left Bitget in 23 transfers within three hours across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%) and Tron (1.8%). The attribution echoes Bitget CEO Gracy Chen and Elliptic, which called a DPRK link \"highly likely.", "body_md": "#### In brief\n\n- Chainalysis attributed the $387 million Bitget hack to North Korea-linked actors, saying it pushed Pyongyang's 2026 crypto theft total past $1 billion.\n- Within three hours, the funds moved across 23 transfers onto Ethereum (49.7%), XRP (40.8%), Zcash (7.6%) and Tron (1.8%).\n- The firm said it used in-house AI to accelerate tracing—compressing 20+ hours of work into minutes—echoing earlier DPRK assessments from Bitget's CEO and Elliptic.\n\nBlockchain analytics firm Chainalysis has pinned last month's $387 million [Bitget exchange hack](https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets) on North Korea, adding its weight to a growing consensus that Pyongyang's hackers were behind one of the year's largest crypto thefts.\n\nIn a report published Wednesday, Chainalysis attributed the Sept. 24 breach to actors tied to the Democratic People's Republic of Korea, saying the heist pushed the total value of crypto stolen by North Korea-linked groups in 2026 past $1 billion.\n\nThe firm said it had been working with Bitget and law enforcement to trace the funds across multiple blockchains since the attack.\n\nChainalysis laid out how quickly the money moved. In the first three hours, $387 million left Bitget across 23 transfers and landed on four networks: Ethereum, which took nearly half at 49.7%, followed by XRP at 40.8%, Zcash at 7.6% and Tron at 1.8%.\n\nFrom there, the attackers ran the funds through cross-chain liquidity and messaging protocols, instant swaps, and laundering services to obscure the trail.\n\nThe stolen XRP drew particular attention. Rather than routing it to an exchange, the attackers pushed it through a cross-chain liquidity protocol and pulled Bitcoin out the other side, with tens of millions of dollars moving that way over roughly a day and a half before reaching attacker-controlled Bitcoin addresses now under watch.\n\nNotably, Chainalysis said it leaned on in-house AI to keep pace, building custom automation that compressed what it estimated as more than 20 hours of manual bridge reconciliation into under 10 minutes.\n\nThe firm stressed the technology accelerated its investigators rather than replacing them, with humans still directing the work.\n\nThe attribution echoes earlier assessments. Bitget CEO Gracy Chen said the attack's patterns matched North Korean hackers, and the blockchain analytics firm Elliptic called a [DPRK link \"highly likely.\"](https://decrypt.co/379350/bitget-hack-387m-what-happened-why-north-korea-suspect)\n\nThe hacker’s crypto laundering has played out in public, with eagle-eyed sleuths tracking every move. The attacker began [hiding funds in Zcash's shielded pool](https://decrypt.co/379759/bitget-hacker-zcash-private-pool-near-thorchain), while swap services split in their response: Near Intents rejected more than $50 million in swaps tied to the hacker, [only to be hacked itself days later](https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker), while Thorchain kept processing.\n\nCircle and Tether, meanwhile, [froze roughly $318,000 in stablecoins](https://decrypt.co/379365/circle-tether-freeze-stablecoins-bitget-hack).", "url": "https://wpnews.pro/news/chainalysis-used-ai-to-trace-the-387m-bitget-hack-back-to-north-korea", "canonical_source": "https://decrypt.co/380005/chainalysis-ai-87m-bitget-hack-north-korea", "published_at": "2026-10-03 17:01:03+00:00", "updated_at": "2026-10-03 17:07:23.102403+00:00", "lang": "en", "topics": ["artificial-intelligence"], "entities": ["Chainalysis", "Bitget", "North Korea", "Gracy Chen", "Elliptic", "Ethereum", "XRP", "Zcash"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/chainalysis-used-ai-to-trace-the-387m-bitget-hack-back-to-north-korea", "markdown": "https://wpnews.pro/news/chainalysis-used-ai-to-trace-the-387m-bitget-hack-back-to-north-korea.md", "text": "https://wpnews.pro/news/chainalysis-used-ai-to-trace-the-387m-bitget-hack-back-to-north-korea.txt", "jsonld": "https://wpnews.pro/news/chainalysis-used-ai-to-trace-the-387m-bitget-hack-back-to-north-korea.jsonld"}}