How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget

What it is

Chainalysis's account of its DPRK-attributed Bitget investigation ($387M stolen Sept 24, 2026), focused on the mechanics of the AI-assisted tracing itself rather than just the outcome.

How it works

The stolen funds left Bitget in 23 transfers within the first three hours, landing on Ethereum, XRP Ledger, Zcash, and Tron. Rather than cashing out via an exchange, attackers routed the XRP through a cross-chain liquidity protocol: depositing an asset on one chain and receiving a different asset on another with no account or intermediary linking the two sides. Each swap still leaves an on-chain record, so investigators matched deposits to corresponding payouts to bridge the gap between chains and extend the trail — tens of millions of dollars moved through this mechanism over roughly a day and a half before reaching attacker-controlled Bitcoin addresses. Beyond this liquidity protocol, Chainalysis also identified cross-chain messaging protocols, instant swaps, and known laundering services used along the way. The automation worked on top of Chainalysis's existing decade-plus cross-chain attribution dataset, which is what let the agentic tooling connect activity across protocols that would otherwise look unrelated.

What to do

• Compliance teams and law enforcement should expect fast-turnaround labeling: Chainalysis states flagged addresses went live in its data platform "within minutes" of identification, so counterparties relying on Chainalysis feeds should pull updates frequently during an active DPRK-linked incident rather than treating labels as static.
• Exchanges/issuers interacting with cross-chain liquidity protocols should know these can be used to convert stolen assets (e.g., XRP) into a different asset on a different chain without a custodial choke point — monitoring needs to span both legs of such swaps, not just the origin chain.
• Chainalysis says it will continue monitoring the Bitget funds and labeling new destination addresses in the coming weeks, and teases further detail on its "next generation" investigative tooling on November 19, 2026 — worth checking back if evaluating their platform roadmap.

Caveats

No specific protocol, bridge, or service names are disclosed; the mechanism is described generically. No addresses, transaction hashes, or screenshots of the actual AI tooling are provided.