Chainalysis Uses AI Tools to Trace $387 Million Stolen from Bitget
Summary
Chainalysis says custom AI automation helped investigators trace $387 million stolen from Bitget across multiple blockchains, cutting one bridge-reconciliation task from over 20 hours to under 10 minutes.
Key points
- DPRK-attributed attackers stole $387 million from Bitget on September 24, 2026.
- Within three hours, the funds had moved across Ethereum, XRP, Zcash, and Tron.
- Attackers used cross-chain liquidity and messaging protocols, instant swaps, and laundering services to move the funds.
- Chainalysis used custom AI-powered automation to match cross-chain deposits and payouts; one task took under 10 minutes instead of more than 20 hours of manual work.
- Investigators reviewed the automation’s outputs and directed the investigation; Chainalysis says AI did not replace human expertise.
- Chainalysis added labels for identified stolen funds and says it will continue monitoring destinations and sharing intelligence with exchanges, issuers, and law enforcement.
- The theft brings the value of crypto stolen by North Korea-attributed actors in 2026 to more than $1 billion, according to Chainalysis.
Article Details
- Event Type
- DPRK-attributed cryptocurrency theft from Bitget, followed by cross-chain laundering
- Impact
- Attackers stole $387 million from Bitget. Within three hours, funds had moved across Ethereum, XRP, Zcash, and Tron, then through cross-chain protocols, instant swaps, and laundering services. Chainalysis reported that the theft brought the value of cryptocurrency stolen by North Korea-attributed actors in 2026 to more than $1 billion.