Chainalysis attributed the $387 million Bitget hack to North Korean threat actors using artificial intelligence to trace stolen funds across blockchains, according to the firm's analysis published this week.
The attribution represents the largest confirmed cryptocurrency theft of 2026. Chainalysis said its AI system compressed what would have required over 20 hours of manual cross-chain tracing into under 10 minutes, accelerating the identification of the North Korean wallet addresses that received the stolen funds immediately after the September 24 hack.
Bitget, a Singapore-registered cryptocurrency exchange, confirmed the breach affected a portion of its user deposit reserves. The exchange announced a recovery plan and said it would cover all losses for affected users. Chainalysis did not disclose the specific methodology behind the AI acceleration, but the firm has expanded its use of machine learning models to detect patterns in fund movement across multiple blockchain networks, a capability that has grown more complex as hackers fragment stolen amounts across bridges and layer-two systems.
North Korea has long been identified by Western governments and cybersecurity firms as a state-sponsored threat actor targeting cryptocurrency platforms and exchanges. The United Nations and U.S. Treasury have previously attributed billions in stolen cryptocurrency to North Korean operatives, who use the proceeds to fund state weapons programs. A 2024 Treasury report estimated North Korea had stolen approximately $1.3 billion in cryptocurrency over the prior five years.
The speed of Chainalysis's attribution differs from historical cases. When the FTX exchange collapsed in 2022, tracing the movement of its customer funds and identifying where they ultimately landed took weeks of forensic work across multiple firms and took months for law enforcement to coordinate. Chainalysis's compression of the tracing timeline to under 10 minutes, if sustained across similar-scale breaches, would represent a five-fold or greater acceleration in the firm's investigation capacity.
Chainalysis provides tracing and compliance services to exchanges, law enforcement, and regulators. The firm has increased its pricing for enterprise clients over the past 18 months, citing the rising complexity of blockchain investigation and the costs of maintaining real-time cross-chain databases. No regulatory agency has yet published its own independent verification of the Chainalysis attribution.
The critical measure is whether U.S. Treasury and State Department officials formally endorse the North Korean attribution in an official advisory or sanctions action, which would carry legal weight for financial institutions and confirm the finding beyond the private sector firm's announcement.
