Blockchain research: Chainalysis AI links Bitget hack to North Korea
Chainalysis says AI helped trace the Bitget hack across four blockchains to North Korea, pushing its 2026 haul past $1B. What it means for crypto security.
Blockchain research is increasingly a race between attackers moving stolen funds and analysts trying to follow them. This week, Chainalysis described how it used in-house AI to win part of that race after the Bitget breach.
Key takeaways
- Chainalysis says the Sept. 24 Bitget breach pushed North Korea’s 2026 crypto theft total past $1 billion, according to Decrypt.
- The firm says it used in-house AI to trace the stolen funds across four blockchains while the attackers were still moving them.
- Decrypt’s headline puts the loss at $387M, though the article’s web address reads “87m”, so confirm the figure against Chainalysis’ own report.
- Recovery is a separate problem: a separate exploit, at Drift, is paying users back only a little over 1% so far.
The news
Chainalysis, the blockchain analytics firm, says the Sept. 24 breach of Bitget has been traced to North Korea. According to Decrypt, the firm says the incident lifted North Korean crypto theft in 2026 beyond $1 billion.
The firm also detailed how it followed the money. It says it used in-house AI to track the stolen assets across four blockchains, describing the effort as a race against the attackers.
The source summary does not say how much was recovered or frozen, which wallets or services were involved, or what the AI actually did. We have not seen Chainalysis’ full technical write-up, so we limit ourselves to what is publicly reported.
Our analysis
The notable part is the method, not the attribution. Stolen funds rarely stay on one chain. Attackers typically split them up and bridge or swap them elsewhere to break the trail. Tracing across four networks means connecting address clusters, bridge transfers and swaps faster than a human team can do manually. That is where automation plausibly helps, though Chainalysis has not said here how much the AI contributed.
What blockchain research can and can’t do here
Tracing is a necessary step toward freezing funds, but it is not the same as recovering them. Analysts can flag addresses and share findings with exchanges and other platforms. Whether any funds are actually stopped depends on who acts, and how quickly. The reported summary describes a race, which suggests speed is the central constraint.
The $1 billion milestone matters for context. It frames North Korea as a persistent, large-scale actor in 2026 theft rather than a source of occasional headline incidents. For exchanges, custodians and protocols, that raises the baseline for threat modeling: the adversary is well-resourced and practiced at laundering across chains.
The aftermath at DeFi protocols shows the other side of the ledger. The Block reports that Drift has opened claims for users hurt by its exploit, with initial payouts of just over 1% of losses. DFX holders can cash out now or wait for more funding, and there is no firm timeline for full repayment. That is a different incident from Bitget, but it illustrates a general point for DeFi analysis: detection and attribution are moving faster than making users whole.
Room for disagreement
Skeptics can reasonably push back on several points. “AI-assisted tracing” is a broad label, and without technical detail it is hard to separate real capability from marketing. Chainalysis is also a commercial vendor, so its framing of its own tools, and of attribution, is not an independent finding.
There is also a data-quality caveat. Decrypt’s headline cites $387M, while its URL suggests $87M. Readers should treat the loss figure as unconfirmed until it is checked against primary sources.
Finally, a fast trace does not guarantee consequences for the attackers. If the funds cannot be frozen, the analytical win is mostly informational.
What to watch
- Chainalysis’ full report: whether it publishes methodology, loss figures and any recovery or freeze data.
- Bitget’s response: how the affected platform handles user impact and what it discloses.
- Cross-chain choke points: whether bridges and swap venues tighten controls in response to the four-chain laundering path.
- Recovery rates: whether payouts like Drift’s remain a small fraction of losses as 2026’s theft total grows.
This article is for information only and is not investment advice.
Prepared with AI assistance from public sources and reviewed under our editorial policy. Not investment advice.
