In the fast-moving world of cryptocurrency investigations, every second counts—a reality underscored last week when blockchain intelligence firm Chainalysis deployed cutting-edge artificial intelligence to track a massive $387 million exploit targeting the Bitget exchange. When threat actors attributed to North Korea drained the funds in a matter of hours, moving the assets across multiple blockchains and complex financial protocols, traditional manual tracing methods threatened to lag behind. In response, Chainalysis investigators utilized in-house, agentic AI platforms to build custom automations capable of matching the relentless speed of the perpetrators.
The operation, which unfolded in a round-the-clock war room, required constant collaboration between Chainalysis’s Customer Outcomes team, the targeted exchange, and law enforcement partners. As the stolen capital fragmented into hundreds of distinct transfers across the digital asset ecosystem, investigators faced the monumental task of reconciling activity step by step. By leveraging custom-built automation tools instead of relying solely on manual graph building, analysts managed to compress more than 20 hours of tedious bridge reconciliation work into under ten minutes.
This technological leap did not replace human expertise; rather, it supercharged it. Investigators continued to define the underlying logic, review machine-generated outputs, and direct the broader trajectory of the case. The agentic platform empowered experts to interrogate diverse data sources rapidly, yielding custom solutions tailored precisely to the demands of the Bitget incident. Within minutes of identifying the illicit transfers, updated labels flagging the stolen capital went live on the platform, providing compliance teams and global law enforcement agencies with the actionable data required to intervene.
Reconstructing the Path of Stolen Funds
The scale of the initial breach was immense. Within the first three hours following the exploit, the $387 million vanished from Bitget across 23 distinct transactions. The assets quickly dispersed across four separate blockchains, landing primarily on Ethereum, which absorbed 49.7% of the stolen funds. XRP accounted for another 40.8%, while Zcash captured 7.6% and Tron held 1.8%. From these entry points, the threat actors implemented sophisticated laundering mechanisms, utilizing cross-chain liquidity networks, messaging protocols, instant token swaps, and established laundering services designed to obscure the trails.
Tracking the XRP portion of the stolen funds presented a particularly intricate challenge. Rather than depositing the assets into a traditional centralized exchange where accounts could potentially be frozen, the perpetrators funneled the tokens through a cross-chain liquidity protocol, extracting Bitcoin on the receiving end. Such protocols enable users to deposit a digital asset on one blockchain and receive an entirely different asset on another without an intermediary or a registered account connecting the two sides. While this process bypasses traditional gatekeepers, every swap leaves an indelible on-chain record.
Chainalysis investigators successfully matched these deposits to their corresponding payouts, effectively bridging the gap between disparate blockchains and extending the investigative trail. Over the course of roughly a day and a half, tens of millions of dollars flowed through this mechanism. Analysts traced the capital through subsequent on-chain protocols before ultimately landing the funds in attacker-controlled Bitcoin addresses that remain under active surveillance. This breakthrough tracing was made possible by operating the automation tools on top of more than a decade of proprietary cross-chain attribution data, which links protocol activities that would otherwise appear completely unrelated.
The Broader Context of State-Sponsored Crypto Theft
The Bitget exploit highlights a troubling evolution in cybercrime, particularly regarding the tactics employed by state-sponsored threat actors. Attribution models and intelligence assessments point toward North Korea—specifically groups linked to the Democratic People’s Republic of Korea (DPRK)—as the driving force behind the attack. This single incident elevates the total value of cryptocurrency stolen by North Korea-attributed actors in 2026 alone to more than $1 billion.
As these threat groups increasingly adopt sophisticated automation to rapidly move, fragment, and obscure stolen digital assets, cybersecurity investigators and blockchain analysts must keep pace. The ability to quickly identify, label, and understand illicit on-chain activity has transitioned from a useful advantage to an absolute necessity. However, technology alone cannot solve these complex financial crimes; it must be paired with the rigorous human judgment and deep investigative expertise required to interpret convoluted transaction webs.
As the investigation progresses into its next phases, the focus shifts toward continuous monitoring and disruption. Chainalysis plans to leverage its custom tooling in the coming weeks to track the remaining stolen capital, apply real-time labels to newly identified destination addresses, and maintain close coordination with cryptocurrency exchanges, asset issuers, and international law enforcement agencies. This ongoing collaboration aims to restrict the utility of the stolen funds and support broader efforts to dismantle the financial infrastructure utilized by cybercriminals.
Crypto Wallets & Security
Crypto Wallets & Security
Crypto Wallets & Security
