Chainalysis Attributes Bitget Hack to North Korea

Blockchain analytics firm Chainalysis has attributed the recent $387 million Bitget hack to actors linked with North Korea. This attribution contributes to a growing consensus regarding the involvement of Pyongyang's hackers in one of the year's most significant crypto thefts.

The report, released on Wednesday, indicated that the September 24 breach pushed the total value of cryptocurrency stolen by North Korea-linked groups in 2026 beyond $1 billion.

Chainalysis has been collaborating with Bitget and law enforcement to trace the stolen funds across various blockchains since the attack. The firm detailed the rapid movement of the funds, noting that within the first three hours, $387 million departed Bitget through 23 transfers.

These funds were distributed across four networks: Ethereum received 49.7%, XRP 40.8%, Zcash 7.6%, and Tron 1.8%. Subsequently, the attackers utilized cross-chain liquidity and messaging protocols, instant swaps, and laundering services to obscure the transaction trails.

The stolen XRP assets were routed through a cross-chain liquidity protocol, where they were exchanged for Bitcoin. Tens of millions of dollars moved in this manner over approximately 36 hours before reaching attacker-controlled Bitcoin addresses, which are now under surveillance. The firm also highlighted its use of in-house artificial intelligence to accelerate the tracing process for the Bitget hack.

This AI created custom automation that reduced over 20 hours of manual bridge reconciliation work to under 10 minutes. Chainalysis clarified that this technology augmented, rather than replaced, human investigators.

This assessment aligns with earlier statements from Bitget CEO Gracy Chen, who observed patterns consistent with North Korean hacking groups, and blockchain analytics firm Elliptic, which deemed a DPRK link highly probable.

The laundering activities of the hackers have been publicly observed, with some funds moved to Zcash's shielded pool. Responses from swap services varied; Near Intents rejected over $50 million in swaps linked to the hacker, while Thorchain continued to process transactions. Additionally, Circle and Tether froze approximately $318,000 in stablecoins associated with the incident.