DPRK-attributed threat actors stole $387 million from Bitget on September 24, 2026, moving the assets through 23 initial transfers across Ethereum, XRP Ledger, Zcash, and Tron. Chainalysis used investigator-directed AI automation to reconcile cross-chain transactions, reportedly reducing more than 20 hours of manual bridge analysis to under 10 minutes. The attackers used cross-chain protocols, instant swaps, mixers, decentralized exchanges, and laundering services, with some stolen XRP converted into Bitcoin and traced to monitored attacker-controlled addresses. The theft raised North Korea-attributed cryptocurrency losses in 2026 above $1 billion.