How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget

What happened

As can be seen in the graph below, which shows a portion of the transfers, hundreds of transfers have been carried out since the attack began. Summary Since $387 million was stolen from Bitget on September 24, Chainalysis investigators have been working with the exchange and… The post How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget appeared first on Chainalysis .

The funds were transferred between different networks, such as from Ethereum to Bitcoin. The ability to quickly identify and understand illicit activity is increasingly important as DPRK and other threat actors (the person or group behind an attack) use sophisticated automation to move and obscure stolen funds.

Investigators must keep pace with these tactics while applying the judgment and expertise needed to make sense of complex on-chain (recorded on the blockchain itself rather than beside it) activity. That makes speed a critical part of the investigative process.

In the first three hours after the exploit, $387 million left Bitget across 23 transfers, landing on four chains: Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%), as shown below. Rather than sending the XRP to an exchange, the attackers pushed it through a cross-chain liquidity protocol and took Bitcoin out the other side. But each swap still leaves an on-chain record.