Twenty hours of tracing done in ten minutes
Chainalysis describes automating the cross-chain reconciliation behind the $387 million Bitget theft attributed to North Korea.
2 minInstitutional ReportsFresh · 1 Oct
Chainalysis has published an account of its work tracing the $387 million stolen from the exchange Bitget on 24 September, an attack attributed to North Korea that takes the total value of crypto stolen by DPRK actors in 2026 past $1 billion. The firm has been working with the exchange and law enforcement to follow the funds across several blockchains.
The dispersal was immediate. In the first three hours after the exploit the money left Bitget in 23 transfers onto four chains: Ethereum took 49.7%, XRP 40.8%, Zcash 7.6% and Tron 1.8%. From there the firm identified distinct laundering routes, including cross-chain liquidity and messaging protocols, instant swaps and links to laundering services.
What the automation actually did
Rather than a tool for drawing graphs, the firm describes building custom automations during the investigation on its own agentic platform, which let investigators query its data and other sources and assemble solutions fitted to this case. The concrete figure it gives is the useful one: more than 20 hours of manual bridge reconciliation compressed to under 10 minutes. Within minutes of identification, labels flagging the stolen funds were live in its data platform, where compliance teams and law enforcement could act on them.
The stolen XRP shows why reconciliation was the bottleneck. Instead of sending it to an exchange, the attackers pushed it through a cross-chain liquidity protocol and took Bitcoin out the other side. Such protocols let someone deposit one asset on one chain and receive another elsewhere with no account linking the two sides, but each swap still leaves a record, and the work is matching deposits to their corresponding payouts.
Chainalysis is careful about the claim it is making. The automation did not replace investigative judgment: its investigators defined the logic, reviewed the outputs and directed the work. The argument is about speed, and about keeping pace with adversaries who use automation of their own to move and obscure funds.
Retold from Chainalysis. This is a summary in our own words; follow the link for the original reporting.