North Korea-Linked Actors Tied to $387M Bitget Hack

Chainalysis has attributed a $387 million hot-wallet theft on Bitget to North Korea-linked actors. The breach occurred on September 24, and within three hours, the stolen funds were transferred out of the exchange in 23 transactions.

The stolen funds were distributed across four blockchains: Ethereum received 49.7%, XRP 40.8%, Zcash 7.6%, and Tron 1.8%. The attackers used a cross-chain liquidity protocol to launder tens of millions of dollars, ultimately pulling Bitcoin out the other side.

The firm's AI-assisted cross-chain tracing identified the laundering path over roughly a day and a half by matching deposits to their corresponding payouts. Chainalysis investigators built custom automation on its agentic platform to accelerate complex cross-chain tracing.