Chainalysis Uses AI to Link $387M Bitget Hack to North Korea

Chainalysis AI traces Bitget breach

On September 24, attackers exploited a vulnerability in Bitget’s wallet infrastructure, draining approximately $387 million in various crypto assets. Chainalysis announced that its proprietary AI system followed the stolen funds as they moved across four distinct blockchains, a process the firm described as a race against the hackers who attempted to launder the proceeds in real time.

Attribution to North Korea

The analysis concluded that the ultimate destination of the funds matched known wallets linked to the Lazarus Group, the cyber unit historically tied to North Korea’s reconnaissance bureau. Chainalysis said the attribution allowed it to update its estimate of the regime’s crypto‑related earnings for 2026, which now exceeds $1 billion when this incident is added.

Implications for market monitoring

While the firm did not disclose the specific chains involved, it noted that the AI model cross‑referenced transaction patterns, timing anomalies and clustering techniques to reduce false positives. The case underscores how on‑chain surveillance tools are increasingly used to connect large‑scale thefts to state‑sponsored actors.

Source: Decrypt