AI traced the Bitget hack. Did it matter?

Chainalysis says it used in-house AI to trace the $387 million Bitget hack back to North Korea-linked actors within days of the Sept. 24 breach. The firm says the theft pushed Pyongyang's 2026 crypto haul past $1 billion, tracking stolen funds as they moved across four blockchains.

The attribution race

Chainalysis frames this as a speed contest: its models mapped the laundering path about as fast as the attackers could move money through mixers and bridges. The firm has built a reputation on this kind of fast-turnaround attribution, and it's now selling AI as the reason the turnaround got faster.

• Bitget hack losses: $387 million, per Chainalysis's analysis cited by Decrypt.
• North Korea's cumulative 2026 crypto theft total: over $1 billion, according to the same report.
• Stolen funds moved across four separate blockchains before being traced, Chainalysis says.
• The breach occurred Sept. 24, 2026, with attribution work following in close succession.

What the attribution actually buys

The default read is that faster tracing means faster justice: name the thief, freeze the wallets, recover the funds. Chainalysis's own numbers argue against that read. North Korea has now crossed $1 billion stolen in a single year, and attribution speed hasn't dented the pace of new hacks landing.

Attribution is forensic, not preventive. Chainalysis can tell a victim exchange who took the money and how it moved, often within days. It can't stop the money from reaching a state that has spent a decade building laundering infrastructure specifically to survive this exact kind of tracing.

The AI improvement is real on its own terms. Mapping four blockchains worth of hops in near-real time is a harder technical problem than it sounds, and doing it faster shrinks the window attackers have to cash out before exchanges freeze addresses.

But the freeze only works if the funds are still sitting somewhere freezable. North Korean operators have shown repeatedly they can move through chain-hopping and over-the-counter desks faster than compliance teams can act on fresh attribution.

The $1 billion threshold is the real headline here, not the AI tooling. It means attribution, however fast, is running alongside a theft rate that keeps climbing regardless.

Bitget absorbing a $387 million loss and North Korea still clearing a billion for the year says the deterrent effect of naming the attacker is thin. Exchanges that build faster detection are still playing defense against an adversary that treats these hacks as a funded state program, not opportunistic crime.

What would change the picture

The number worth watching isn't how fast Chainalysis names the next attacker. It's whether the attribution speed starts translating into actual fund recovery or frozen on-chain balances before cash-out completes.

• Whether any portion of the $387 million gets frozen or recovered, versus fully laundered and converted.
• Whether North Korea's 2026 total keeps climbing past $1 billion in subsequent quarters despite faster AI attribution.
• Whether exchanges adopt Chainalysis's tooling pre-emptively, shrinking the window between breach and freeze from days to hours.