Chainalysis Ties $387M Bitget Hack to North Korea, Lifting 2026 DPRK Haul Past $1B

Blockchain analytics firm Chainalysis has attributed the $387 million hack of crypto exchange Bitget to actors linked to North Korea. The firm says the September 24, 2026 breach pushes the country’s crypto theft for 2026 above $1 billion. Both figures are reported by two independent outlets, Decrypt and CoinGape, and both credit Chainalysis’s in-house AI tooling with a role in following the stolen funds.

Source basis at a glance: Two independent reports. Confirmed by both: the $387M loss, the Sept. 24 date, the DPRK attribution, the 2026 total passing $1B, and the use of in-house AI. Single-source: the four-blockchain trace (Decrypt) and the 20-hours-to-under-10-minutes speed claim (CoinGape).

What Two Independent Reports Agree On

The core numbers are consistent across both outlets. Bitget lost $387 million on September 24. Chainalysis links the attackers to the Democratic People’s Republic of Korea, the state already tied to many of the largest exchange thefts in the sector’s history.

The cumulative figure deserves attention. By Chainalysis’s count, this single incident is enough to carry North Korea’s 2026 haul past the $1 billion mark. A $387 million loss alone represents well over a third of that threshold, so one breach has reshaped the year’s tally for state-linked theft.

Both outlets also describe Chainalysis using its own AI systems during the investigation, framed as a race to keep pace with the attackers as they moved funds. That point is not in dispute between the two reports.

Single-Source Claims: Speed and Chain Count

Two specifics appear in only one report each, so Cryptaur treats them as attributed rather than confirmed. Decrypt reported that the stolen funds were traced across four blockchains. CoinGape reported that the AI compressed more than 20 hours of manual bridge reconciliation into under 10 minutes.

Neither claim is contradicted by the other outlet. They are simply not corroborated. Both also originate with Chainalysis itself, which means the performance figure is a vendor’s description of its own product rather than an independently measured benchmark.

CoinGape added one qualifier worth keeping in view: investigators, not the model, directed the work. In other words, the AI handled reconciliation of bridge transfers while human analysts made the investigative calls. That framing comes from one outlet only.

Bridges Are Where Traces Usually Break

Cross-chain bridges are the slowest part of most hack investigations. When funds leave one network and reappear on another, analysts must match outgoing and incoming transactions by amount, timing and contract behaviour, often by hand. Every hour spent reconciling is an hour attackers can use to swap, split or cash out.

That is the practical stake for exchange users and for anyone building on analytics data. If reconciliation that once took a full working day can be done in minutes, exchanges and issuers get a wider window to flag addresses before funds reach off-ramps. The caveat stands, though. That speed figure currently rests on one report of a company’s own claim.

Earlier on-chain activity tied to the breach showed the attackers converting assets. Cryptaur previously covered a hack-linked wallet swapping ETH into BTC through THORChain, a pattern consistent with the multi-chain movement Chainalysis describes.

Read more: Bitget Hack Wallet Swaps 2,390 ETH for 75.2 BTC as THORChain Denies Freeze

Data-Quality Note

Attribution here comes from a single analytics firm, reported by two outlets. That makes the event well documented, though it is not independently attributed by a second forensic team. Neither report cited a public recovery figure. The number holders should track next is any update to the $387 million loss total or to North Korea’s 2026 tally, now above $1 billion.

Sources

• decrypt.co
• coingape.com