On September 24, 2026, DPRK-attributed threat actors stole $387 million from cryptocurrency exchange Bitget. Chainalysis investigators utilized in-house artificial intelligence to build custom automations that accelerated the tracing of these funds across multiple blockchains. The team reported that more than 20 hours of manual bridge reconciliation were compressed into under 10 minutes using this technology. Within three hours of the exploit, the stolen assets had moved across four chains: Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%).
The attackers employed sophisticated laundering mechanisms, including cross-chain liquidity protocols, instant swaps, and messaging services, to obscure the trail. For instance, XRP was pushed through a cross-chain liquidity protocol to convert into Bitcoin on another network, bypassing traditional exchanges. Chainalysis matched deposits to payouts using attribution data built over more than a decade, extending the investigative trail to attacker-controlled Bitcoin addresses now under monitoring. This theft pushes the total value of crypto stolen by North Korean actors in 2026 past $1 billion. Chainalysis continues to label linked addresses and share intelligence with law enforcement and exchange partners to disrupt further movement of the funds.
The deployment of agentic AI platforms for real-time forensic accounting marks a pivotal shift in how blockchain security firms respond to high-value exploits. By automating the reconciliation of complex cross-chain transactions, investigators can maintain pace with threat actors who increasingly use sophisticated automation to move and obscure stolen funds. This capability reduces the latency between theft identification and actionable intelligence, allowing compliance teams and law enforcement to freeze or block assets before they are fully laundered.
However, the efficacy of these tools relies heavily on the underlying historical attribution data rather than AI acting as an autonomous investigator. Human experts remain central to defining logic and interpreting outputs, ensuring that automated speed does not compromise accuracy. As North Korean theft totals exceed $1 billion in 2026, the industry must watch how regulatory frameworks adapt to require faster reporting timelines and deeper integration of automated tracing capabilities within institutional custody and compliance infrastructure.
