Chainalysis attributed Bitget’s September 24, 2026 theft of about $387 million to North Korean actors after tracing 23 transfers across Ethereum, XRP, Zcash and Tron. Investigators used custom AI-assisted automation to match cross-chain transactions and reduce a bridge-reconciliation task from more than 20 hours to under 10 minutes, while retaining control over matching rules, lead selection and review. The attackers moved stolen XRP through a cross-chain liquidity protocol that paid out Bitcoin, with tens of millions of dollars passing through the route over roughly a day and a half. Bitget said a vulnerability in a third-party security product enabled attackers to obtain credentials and forge withdrawal commands, while cold wallets and private keys remained secure. The exchange restored Bitcoin, Ether and USDT withdrawals by September 30, offered separate 5% rewards for qualifying freezes and recoveries, and said customer balances were unaffected.