Chainalysis attributed the $387 million Bitget theft to North Korean hackers. Chainalysis said the attack brought the value of crypto stolen by North Korea-linked actors in 2026 above $1 billion. North Korean attackers reportedly converted stolen XRP into Bitcoin through a cross-chain liquidity protocol rather than an exchange. Chainalysis counted 23 outbound transfers across four blockchains in the first three hours after the September 24 exploit. Chainalysis said its in-house AI reduced more than 20 hours of manual cross-chain reconciliation to under 10 minutes, with investigators setting the logic and reviewing results.