Chainalysis says it used in-house AI to trace the September 24 Bitget hack, recovering a path for roughly $387 million in stolen cryptocurrency and linking the attack to North Korea. The firm says the breach pushed North Korea’s tracked 2026 crypto haul past $1 billion, and it used AI to follow the stolen funds across four blockchains in a race against the attackers.
The tracing effort combined blockchain analytics with automated pattern recognition to follow movement of the funds after the initial exploit. Chainalysis said the AI systems were built internally and were specifically applied to the Bitget incident, which occurred on September 24.
Key Facts
- $387M in crypto stolen in the Bitget hack was traced by Chainalysis.
- AI built in-house was used to trace the funds.
- The breach occurred on September 24.
- North Korea was identified as the source of the attack.
- The stolen amount raised North Korea’s 2026 crypto haul past $1 billion.
- The funds were tracked across four blockchains.
How Did They Trace the Bitget Hack?
Chainalysis said the September 24 breach was analyzed using artificial intelligence systems developed internally. The firm said these tools traced movement of the stolen funds across four separate blockchains. According to Decrypt, the tracing process was described as a race against the attackers, implying rapid movement of funds after the initial exploit.
The use of AI reportedly allowed faster identification of transaction patterns than traditional manual methods. The Bitget hack occurred on September 24, and Chainalysis said the AI tools were applied directly to that incident.
Who Is Affected by the Bitget Hack?
The Bitget hack affected the cryptocurrency exchange and its users, with roughly $387 million in assets reported stolen. Chainalysis said tracing the funds was part of an effort to assist in recovery and attribution.
North Korea was identified as the source of the attack, according to the firm. The breach also contributed to North Korea’s total tracked crypto theft for 2026 exceeding $1 billion, per Chainalysis.
What Is the Broader Context of Crypto Hacks?
The Bitget hack fits into a larger pattern of high-value cryptocurrency thefts linked to state-sponsored actors. Chainalysis said North Korea’s tracked crypto haul for 2026 surpassed $1 billion following this incident.
Cross-chain tracing, as used here across four blockchains, has become a key challenge in tracking stolen funds. The use of AI tools by firms like Chainalysis is increasingly common in attempts to keep pace with complex transaction flows.
What We Know — and What We Don’t
Verified by the source:
- Chainalysis used in-house AI to trace the $387M Bitget hack.
- The breach occurred on September 24.
- The funds were tracked across four blockchains.
- North Korea was named as the source.
- The incident raised North Korea’s 2026 crypto haul past $1 billion.
Still unconfirmed:
- Exact technical methods used by Chainalysis AI.
- Whether any stolen funds were recovered.
- Independent corroboration of the attribution.
- Specific details about the four blockchains involved.
- Bitget’s official response to the tracing claim.
Chainalysis’s ability to link major hacks to state actors helps exchanges and governments understand the scale of North Korean cyber threats. Crypto tracing remains critical as thefts grow larger and more complex.
Why It Matters
Linking major hacks to state actors helps shape sanctions and security policy. For readers tracking crypto markets, attribution affects exchange security measures and investor risk perception.
What To Watch
Further details may emerge if Chainalysis releases additional technical documentation or if Bitget issues an official statement confirming the tracing results.