Bitget's $387M Heist, Zapped in 10 Minutes: AI Plays Speed Runner With North Korea's Laundry 🧺

Blockchain analytics firm Chainalysis has attributed the Sept. 24, 2026 Bitget exchange breach, which drained $387.5 million, to actors linked to the Democratic People's Republic of Korea, saying the incident pushes North Korea-linked crypto thefts in 2026 past $1 billion. The firm said it has been working with Bitget and law enforcement to trace the stolen assets since the attack was detected. Investigators, not the model, directed the case, the firm stressed, with humans still steering the work.

According to the report, at 18:31 UTC on Sept. 24, Bitget detected unauthorized transfers from its hot and warm wallets, while cold wallets remained untouched. In the first three hours, $387 million left Bitget across 23 transfers and landed on four networks: Ethereum at 49.7%, XRP at 40.8%, Zcash at 7.6%, and Tron at 1.8%. From there, the attackers routed the funds through cross-chain liquidity and messaging protocols, instant swaps, and laundering services to obscure the trail. CEO Gracy Chen later said the attacker's patterns matched North Korean hackers.

The stolen XRP drew particular attention. Rather than routing it to an exchange, the attackers pushed it through a cross-chain liquidity protocol and pulled Bitcoin out the other side, with tens of millions of dollars moving that way over roughly a day and a half before reaching attacker-controlled Bitcoin addresses now under watch. The attacker also began hiding funds in Zcash's shielded pool, while the hacker-exposed funds drew mixed responses from swap services. Circle and Tether froze roughly $318,000 in stablecoins.

Chainalysis said it leaned on in-house AI to keep pace, building custom automation that compressed what it estimated as more than 20 hours of manual bridge reconciliation into under 10 minutes. The firm attributed the September 24 hack to DPRK-linked actors and said the AI handled cross-chain matching at a speed that changes the recovery window for exchanges, issuers, and law enforcement. The attribution echoes earlier assessments from blockchain analytics firm Elliptic, which called a DPRK link "highly likely."