The evidence
In an October 1, 2026 report, Chainalysis described a September 24 theft of approximately $387 million from Bitget. The firm reported 23 transfers in the first three hours, with funds reaching several networks including Ethereum, XRP, Zcash and Tron.
Chainalysis attributed the activity to North Korean actors. Both the incident amount and attribution here are reported from that investigation. FOLITIC has not independently verified the underlying private investigative evidence.
Source: Chainalysis investigation, October 1, 2026.
FOLITIC analysis
A multichain trail cannot be reconstructed by assuming that every similar transfer belongs to the same actor. Different networks use different identifiers, timing conventions and asset representations. A bridge message, service record or other corroborating evidence is needed to connect the steps.
Fragmentation can also inflate a chart of activity. Splitting one balance into many addresses creates more transactions without increasing the amount stolen. Analysts should reconcile the remaining value rather than summing every downstream movement.
The distinction matters for market interpretation. Asset conversion after a theft is different from a voluntary investment decision. A movement into an asset or network may reflect the actor’s routing options rather than confidence in its fundamentals.
What to watch
Look for dated evidence, a clear attribution standard and an explanation of how links between chains were established. Keep reported findings separate from independently observed facts, and avoid treating a connected service or recipient as a participant in the crime without supporting evidence.
Image: Illustrative photograph of network connections, representing the tracing of transfers across multiple systems. Credit: ShakataGaNai via Wikimedia Commons. Image license: CC BY SA 3.0. Displayed with a responsive crop. This illustrative image does not depict the reported transaction.
