Overview
- Chainalysis has identified North Korea-linked individuals as responsible for the $387 million hack of Bitget, pushing the total cryptocurrency stolen by such actors in 2026 beyond $1 billion.
- In just three hours, the stolen funds were moved through 23 transactions, with 49.7% going to Ethereum, 40.8% to XRP, 7.6% to Zcash, and 1.8% to Tron.
- The firm utilized its proprietary AI technology to expedite the tracing process, reducing what would normally take over 20 hours of manual work to just minutes, supporting earlier claims made by Bitget's CEO and Elliptic.
In a recent report, blockchain analytics company Chainalysis has implicated North Korean actors in the significant $387 million hack of the Bitget exchange that occurred last month, reinforcing the view that Pyongyang's cybercriminals are behind one of the largest cryptocurrency thefts of the year.
According to Chainalysis, the breach that took place on September 24 has contributed to a staggering total of over $1 billion in cryptocurrency stolen by North Korea-related groups in 2026.
Myriad: Predict the future of Bitcoin prices! Click here.The firm has been collaborating with Bitget and law enforcement to trace the stolen assets across various blockchains since the incident.
Chainalysis detailed the swift movements of the funds, revealing that within the first three hours, the entire $387 million was transferred through 23 transactions and distributed across four different networks: Ethereum received nearly half at 49.7%, followed by XRP at 40.8%, Zcash at 7.6%, and Tron at 1.8%.
Subsequently, the attackers employed cross-chain liquidity protocols, instant swaps, and laundering services to further obscure the origins of the funds.
Particular attention was given to the stolen XRP, which the hackers funneled through a cross-chain liquidity protocol to convert into Bitcoin, moving tens of millions of dollars within approximately a day and a half before the funds reached Bitcoin addresses controlled by the attackers that are now under scrutiny.
Chainalysis reported that it utilized its in-house AI capabilities to enhance the tracing process, automating tasks that would have taken over 20 hours of manual effort down to less than 10 minutes. The firm emphasized that this technology serves to aid investigators rather than replace them, with human oversight remaining crucial.
This attribution aligns with earlier evaluations, as Bitget's CEO Gracy Chen noted that the attack exhibited patterns typical of North Korean hacking groups, while Elliptic labeled the connection to North Korea as "highly likely."
As the laundering of the stolen cryptocurrency unfolds, keen observers are monitoring each move. The hackers initially started concealing funds in Zcash's shielded pool. Swap services had mixed responses: Near Intents declined over $50 million in swaps related to the hacker, only to experience a hack of its own days later, while Thorchain continued to process transactions.
Additionally, Circle and Tether have frozen approximately $318,000 in stablecoins linked to the hack.