Chainalysis Maps How North Korean Hackers Moved Bitget’s $387M
The investigation into Bitget's September hack has moved beyond counting stolen assets. Blockchain investigators are now reconstructing how the attackers tried to turn a large exchange theft into dozens of disconnected trails across different networks.
Summary:
- Chainalysis attributes the $387 million Bitget theft to North Korea-linked hackers.
- Attackers moved funds across multiple chains and converted part of the stolen assets into Bitcoin.
- AI-assisted tracing cut hours of cross-chain analysis to minutes.
- Earlier forensic reports estimated the theft at $351.6 million.
Chainalysis said on Oct. 1 that $387 million left Bitget in 23 transfers during the first three hours of the attack, landing across Ethereum, XRP Ledger, Zcash and Tron. The firm attributes the operation to North Korean threat actors and says the theft has pushed DPRK-linked crypto theft above $1 billion in 2026.
That assessment goes further than some of the earliest forensic reports.
TRM Labs initially tracked approximately $351.6 million leaving Bitget’s hot and warm wallets and described North Korean involvement as likely, but stopped short of definitive attribution at the time. Scorechain also used the $351.6 million estimate while attributing attacker wallets to North Korea’s Lazarus Group.
The difference reflects how the investigation expanded after the first hours of the breach. More assets and networks were identified as investigators followed the initial transfers, while attribution confidence also developed as laundering patterns and wallet connections emerged.
The Attackers Did Not Follow One Laundering Route
Chainalysis’ reconstruction shows why the theft became difficult to follow so quickly.
The first wave of stolen funds was distributed across:
- Ethereum: 49.7%
- XRP Ledger: 40.8%
- Zcash: 7.6%
- Tron: 1.8%
From there, investigators identified several laundering methods operating simultaneously, including cross-chain liquidity protocols, cross-chain messaging infrastructure, instant swaps and services already associated with laundering activity. Chainalysis
The XRP route provides one of the clearest examples.
Rather than depositing stolen XRP directly onto a centralized exchange, the attackers fed it into cross-chain liquidity infrastructure and received Bitcoin on the other side.
That changes the investigative problem. The original XRP transaction and resulting BTC payout exist on separate ledgers and use different assets. Investigators have to determine which deposit corresponds with which payout before they can continue tracing the Bitcoin.
Chainalysis says tens of millions of dollars passed through this mechanism over roughly a day and a half. Its investigators matched the transactions and eventually followed the proceeds into attacker-controlled Bitcoin addresses that remain under surveillance.
TRM Traced Another Route Through THORChain
Separate work by TRM Labs provides more detail on some of the infrastructure involved.
TRM identified THORChain as one of the routes used to convert stolen assets into Bitcoin. Its analysis followed approximately $9.8 million in BNB from a Bitget hot wallet through several intermediary wallets before portions were sent through THORChain in smaller transactions and converted into BTC.
The firm also traced stolen TRX through a longer sequence.
According to TRM, TRX was swapped into USDT through SunSwap, moved to Ethereum using USDT0 and subsequently entered the same THORChain route. Smaller amounts passed through Across, Bridgers, Chainflip and FixedFloat. trmlabs.com
This is more useful than simply saying the hackers “bridged” the money.
The laundering pattern repeatedly changes both the network and the asset, forcing investigators to reconnect the trail after each conversion. It also delays interaction with centralized exchanges, where account controls and transaction monitoring create potential intervention points.
Chainalysis Automated the Most Labor-Intensive Part
Following those routes manually creates another problem: time.
Chainalysis estimates that one portion of the Bitget investigation would have required more than 20 hours of manual bridge reconciliation. Custom automation built with its in-house AI reduced that work to under 10 minutes.
The AI did not independently investigate the theft.
Chainalysis says its investigators defined the tracing logic, reviewed the output and decided where to continue the investigation. Automation handled repetitive reconciliation across transaction and attribution datasets.
READ MORE: Tether’s $550M Iran Freeze Exposes Stablecoins’ Sanctions Chokepoint
The practical result was faster labeling.
Once investigators identified addresses receiving stolen funds, Chainalysis says those labels became available in its platform within minutes. Exchanges and other compliance teams using the data could then identify exposure when flagged assets reached their infrastructure.
In a cross-chain theft, that time difference can affect whether a service encounters stolen assets before or after the attacker moves them again.
Why Early Estimates Put the Theft at $351.6 Million
The changing dollar figure is worth separating from the laundering analysis.
TRM’s Sept. 25 report estimated the theft at $351.6 million and tracked unauthorized transfers across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base. Approximately $158 million of the observed value was XRP.
Scorechain independently used the same $351.6 million figure and had mapped 28 attacker-controlled addresses across eight networks by Sept. 25. At that stage, it estimated that roughly $183 million in ETH and $158 million in XRP remained largely untouched in attacker wallets.
Chainalysis’ later reconstruction uses $387 million and includes Zcash and Tron in its initial three-hour distribution.
Those numbers should therefore be read with their timestamps and methodologies attached. Blockchain investigations evolve as previously unidentified transfers are classified, addresses are clustered and cross-chain transactions are linked.
The same caution applies to attribution.
TRM said the laundering trail overlapped with infrastructure previously used in North Korean operations, including the Bybit and AFX Bridge thefts, but its Sept. 25 assessment did not definitively attribute the Bitget attack to North Korea. Chainalysis’ Oct. 1 report does.
That distinction is more informative than presenting every forensic provider as if they reached the same conclusion at the same time.
Tracing Bitcoin Does Not Mean Recovering It
The laundering routes also expose the limit of blockchain transparency.
Moving XRP into Bitcoin does not erase the transaction history. Investigators can reconstruct the swap, identify the resulting BTC and monitor where it moves next.
But identifying an address does not give investigators control over its assets.
Centralized exchanges can potentially freeze deposits associated with stolen funds. Stablecoin issuers may also be able to restrict specific tokens. Native BTC held in an attacker-controlled wallet has no equivalent issuer capable of freezing it.
Investigators therefore need another intervention point.
If the Bitcoin later reaches a compliant exchange, custodian or another service capable of restricting the assets, previously distributed wallet labels can become operationally useful. Until then, investigators may know where the money is without being able to seize it.
That explains why the speed improvement highlighted by Chainalysis matters more than the AI label itself. The goal is to reconstruct cross-chain movements before the stolen assets arrive at a service capable of acting on that intelligence.
North Korean Attribution Raises the Stakes
Chainalysis says the Bitget theft has taken cryptocurrency stolen by North Korean actors in 2026 above $1 billion. Chainalysis
The firm’s attribution is also stronger than the language used in the earliest days after the attack.
TRM found laundering links to wallets associated with previous North Korean thefts and said the same laundering network had been observed in connection with TraderTraitor operations. But it acknowledged that another attacker using the same infrastructure remained technically possible when its report was published on Sept. 25.
Chainalysis now categorizes the Bitget incident as DPRK-attributed.
The investigation is still active. Chainalysis says it will continue monitoring destination addresses and distributing new labels to exchanges, issuers and law-enforcement partners as the stolen assets move.
That makes the next stage measurable: not another estimate of how much was stolen, but whether the monitored Bitcoin and other assets eventually reach services where tracing can be converted into freezes or recoveries.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investme nt, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
