Chainalysis has attributed the $387 million theft from Bitget to DPRK-linked threat actors after tracing stolen assets across multiple blockchain networks. The investigation revealed that $387 million left Bitget in 23 transfers during the first three hours following the September 24 exploit. Ethereum accounted for 49.7% of the stolen funds, followed by XRP at 40.8%, while Zcash and Tron represented 7.6% and 1.8%, respectively.
The attackers fragmented the assets immediately, moving tens of millions of dollars through a cross-chain liquidity protocol to convert XRP into Bitcoin over roughly a day and a half. Chainalysis utilized custom automation to reduce manual bridge reconciliation time from more than 20 hours to less than 10 minutes. This incident pushes the total value of cryptocurrency stolen by DPRK-attributed actors in 2026 above $1 billion. Bitget reported its Protection Fund held more than $464 million during the incident and was later replenished to more than $300 million.
The rapid fragmentation of $387 million across four distinct blockchains within three hours underscores the evolving sophistication of DPRK-linked threat actors. By leveraging cross-chain liquidity protocols rather than centralized exchanges, attackers attempted to obscure the trail, yet the inherent transparency of these networks allowed investigators to match deposits with corresponding payouts. This case highlights that while blockchain visibility aids reconstruction, the speed of asset movement remains a critical challenge for immediate containment.
From an institutional perspective, the integration of artificial intelligence in forensic analysis marks a significant shift in operational capability. Reducing reconciliation time from hours to minutes enables faster identification of destination addresses, which is crucial for law enforcement and exchanges attempting to freeze assets before they are fully laundered. However, the reliance on human specialists to define logic and review outputs indicates that AI serves as a force multiplier rather than a replacement for expert judgment in complex cross-chain investigations.
