Summary
- Chainalysis used custom AI tools to attribute the October 1 2026 theft of $387 million from Bitget directly to North Korean actors.
- Stolen funds moved across Bitcoin, THORChain, and CoinJoin, with only $840000 publicly frozen to date.
- Bitget confirmed a third-party zero-day exploit that permitted lateral movement inside the wallet environment.
Chainalysis traced the $387 million stolen from Bitget on October 1 2026 to North Korean operators. Its custom AI tools made the link fast. The trail crossed four chains.
This cuts tracing time from twenty hours down to under ten minutes.
Context
North Korea keeps showing up in big crypto thefts this year. Those jobs have racked up roughly a billion dollars in industry losses. The Bitget breach follows the usual pattern of hitting centralized exchange hot wallets.
A third-party zero-day gave the attackers their opening.
No funds have returned so far. No tie to the NEAR Intents case has turned up either.
Details
Chainalysis investigators put their purpose-built AI models to work. The stolen assets moved into Bitcoin, THORChain, and CoinJoin mixers right after the theft.
BlockSec tracked the same path and found only about $840000 frozen on public addresses so far. Bitget later confirmed the third-party zero-day that let attackers move laterally inside its systems.
"Chainalysis has pinned last month's $387 million Bitget exchange hack on North Korea, behind one of the year's largest crypto thefts."
, Attribution (Yahoo)
Chainalysis has added stolen-fund labels to its products. Exchanges and protocols can now spot the addresses more easily. The rest of the balance keeps moving through privacy tools like Zcash pools.
Analysts plan to keep watching the unrecovered funds.