Blockchain analytics company Chainalysis announced that its proprietary artificial‑intelligence system linked the September 24 theft of roughly $387 million from the cryptocurrency exchange Bitget to hackers tied to North Korea. The rapid attribution, achieved in under ten minutes, comes as the exchange scrambles to restore confidence by rebuilding a protection fund valued at about $309 million.
AI‑driven investigation cuts hours to minutes
According to Decrypt, Chainalysis’ AI platform traced the stolen assets across four major blockchains—Bitcoin, Ethereum, Ripple (XRP) and Litecoin—compressing what would have been a 20‑hour forensic effort into a single, ten‑minute analysis. The firm said the AI model leveraged pattern‑recognition algorithms and a proprietary address‑clustering database to follow the funds as they moved through a series of mixers and exchange wallets before landing on accounts previously associated with North Korean cyber‑crime groups.
North Korean attribution and cumulative thefts
Multiple outlets, including Yahoo and CryptoRank, reported that the investigation confirmed the involvement of the Lazarus Group, a state‑sponsored hacking unit linked to the Democratic People’s Republic of Korea. The attribution pushes the estimated total of North Korean crypto thefts in 2026 past the $1 billion mark, a figure first highlighted by finance.biggo.com. The agency’s claim aligns with broader intelligence assessments that North Korea has intensified its cryptocurrency‑theft campaigns to fund its sanctioned nuclear program.
Bitget’s $309 million protection fund
Bitget, which suffered the loss of $387 million (some reports cite $388 million), announced a reconstruction of its user protection fund to $309 million, as detailed by 24/7 Wall St. The fund, financed through a combination of the exchange’s reserves and a private capital injection, is designed to reimburse affected customers and cover future security upgrades. Withdrawals, which were halted immediately after the breach, have now resumed, and the platform says it has introduced multi‑signature wallets, enhanced KYC procedures, and real‑time transaction monitoring.

Wider market fallout
The Bitget incident was one of the two largest hacks recorded in September, contributing to a total of $766 million lost to crypto thefts that month, according to CryptoPotato. The spate of high‑profile breaches has reignited debate among regulators and investors about the resilience of centralized exchanges. While the overall cryptocurrency market remains volatile, with Bitcoin trading around $27,000 and total market capitalization near $1.2 trillion, confidence in custodial solutions continues to be tested.
"Chainalysis’ AI traced the $387 million theft in under ten minutes, a process that would traditionally take twenty hours," the firm said, highlighting a potential paradigm shift in how blockchain crimes are investigated.
Analysts note that the rapid attribution underscores the growing importance of sophisticated analytics in the crypto ecosystem. As law‑enforcement agencies worldwide grapple with the anonymity of digital assets, tools that can swiftly map illicit flows are becoming essential. Bitget’s sizable fund rebuild, while reassuring to its users, also signals that exchanges may need to allocate larger capital buffers to weather future attacks.

Looking ahead, industry observers expect tighter regulatory scrutiny and greater collaboration between exchanges and blockchain‑forensics firms. The Bitget breach, paired with the confirmed North Korean link, serves as a stark reminder that geopolitical actors are increasingly viewing cryptocurrency as a viable revenue stream, prompting both the private sector and governments to bolster defensive and investigative capabilities.
Market Snapshot
| Asset | Price | 24h | Market Cap |
|---|---|---|---|
| $84,713 | +0.12% | $1702.1B | |
| $2,690 | +0.44% | $328.5B | |
| $782.99 | +1.87% | $104.3B | |
| $1.49 | -0.15% | $93.8B | |
| $120.05 | +0.72% | $70.6B | |
| $0.0927 | -0.57% | $14.5B | |
| $0.243 | -1.50% | $9.1B |
Live data: CoinGecko — 2026-10-04 01:22 UTC