Chainalysis links $387 million Bitget hack to DPRK actors

Chainalysis attributed the $387 million Bitget hack to actors associated with North Korea after tracing 23 transactions across four blockchains. The transfers began after the exploit and occurred within about three hours.

Ethereum carried 49.7% of the stolen funds, followed by XRP at 40.8%, Zcash at 7.6% and Tron at 1.8%. Investigators tracked hundreds of additional transfers as the attackers moved assets between networks.

Custom automation helped Chainalysis reconstruct the transaction paths. The tools reduced more than 20 hours of bridge reconciliation work to less than 10 minutes, according to the firm.

The stolen XRP presented a separate tracing challenge. The attackers routed the tokens through a cross-chain liquidity protocol instead of a centralized exchange and received Bitcoin on another blockchain.

Each swap created an on-chain record that investigators matched across networks. Tens of millions of dollars moved through the protocol over about 36 hours. The investigation also identified instant-swap services, cross-chain messaging protocols and services used to launder funds.

Investigators traced the assets to Bitcoin addresses controlled by the attackers. Chainalysis plans to continue monitoring those addresses and coordinating with cryptocurrency exchanges, token issuers and law enforcement agencies.

The attribution connects the hack to North Korea-associated actors, but Chainalysis did not identify a specific group or provide details about the original exploit.