Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea

What it is

Chainalysis's attribution report on the Sept. 24, 2026 Bitget hack ($387M), the detailed post-theft laundering trail, and the specific response actions taken by other protocols and stablecoin issuers as the funds moved.

How it works

After the initial three-hour, 23-transfer split across Ethereum, XRP, Zcash and Tron, the attackers routed the stolen XRP (40.8% of the haul) through a cross-chain liquidity protocol rather than an exchange, converting it to Bitcoin on the other side. Tens of millions moved this way over roughly a day and a half before settling into attacker-controlled Bitcoin addresses that are now under watch. Separately, the attacker began shielding a portion of funds in Zcash's shielded pool to break traceability.

flowchart TD
    A[Bitget hack: $387M, 23 transfers] --> B[XRP: 40.8%]
    B --> C[Cross-chain liquidity protocol]
    C --> D[Swapped to Bitcoin]
    D --> E[Attacker-controlled BTC addresses, now monitored]
    A --> F[Zcash: 7.6%]
    F --> G[Shielded pool - trail obscured]

Preconditions / Affected

Relevant to teams monitoring DPRK-linked laundering flows or evaluating cross-chain bridge/swap exposure: the laundering used instant swaps, messaging protocols, and liquidity bridges that don't require KYC'd exchange on/off-ramps, which is why the XRP-to-BTC leg was harder to interdict than a direct exchange deposit would have been.

What to do

The page names concrete real-world interdiction outcomes worth noting as reference points: Near Intents rejected over $50 million in swaps tied to the hacker (and was itself hacked days later); Thorchain continued processing the attacker's swaps; Circle and Tether froze roughly $318,000 in stablecoins tied to the theft. Teams building transaction-screening or swap-rejection logic now have a concrete precedent (Near Intents' $50M+ rejection) and a counterexample (Thorchain) to compare policies against.

Caveats

The attacker-controlled Bitcoin addresses are described as "now under watch" but the page does not state any funds have been frozen or recovered there. The Near Intents hack that followed its rejection of attacker swaps is reported without a stated causal link to the rejection itself.