Chainalysis AI Identifies $387M Bitget Hack in Less Than 10 Minutes

Chainalysis has leveraged its proprietary AI technology to reduce bridge reconciliation time from over 20 hours to less than 10 minutes while examining the $387 million stolen from Bitget.

In its report dated Oct. 1, Chainalysis revealed that investigators developed custom automation to correlate transactions across different blockchains following the breach on Sept. 24. The significant time savings were related to aligning bridge deposits with payouts, a key aspect of the inquiry involving Bitget and law enforcement partners.

With a team working tirelessly, the firm’s investigators utilized these tools to trail fragmented transaction paths and relay insights to the exchange and regulatory bodies. The report noted that newly discovered addresses were tagged with stolen-fund labels in mere minutes, allowing compliance teams to access the data through their platform.

Chainalysis AI facilitated transfers while investigators managed the case

According to the firm’s methodology, investigators established the matching criteria, assessed the outcomes, and chose which leads to follow. The AI assisted in constructing tools tailored for the specific case rather than taking the reins of the investigation.

The report stated:

“Our investigators still defined the logic, reviewed the outputs, and directed the investigation.”

Utilizing over a decade of cross-chain attribution data, the automation linked deposits from one network to payments on another. The firm emphasized that this technique helped in reconstructing activities that might otherwise seem disconnected when analyzed across different blockchains.

In tracing the stolen XRP, investigators uncovered transfers through a cross-chain liquidity protocol that disbursed Bitcoin instead of directly sending XRP to an exchange. The report indicated that this route facilitated tens of millions of dollars over approximately a day and a half.

After correlating deposits and payouts, investigators tracked subsequent transactions across various protocols to Bitcoin addresses controlled by the attackers. The team continues to monitor the identified locations and plans to label more addresses as funds continue to move.

The Bitget hack transferred $387 million across four chains

Within the initial three hours of the incident, Chainalysis recorded 23 transactions amounting to roughly $387 million being taken from Bitget. The distribution indicated that 49.7% was linked to Ethereum, 40.8% to XRP, 7.6% to Zcash, and 1.8% to Tron.

In addition to the initial withdrawals, the firm pinpointed cross-chain liquidity and messaging protocols, instant-swap services, and connections to laundering activities. Its published transaction diagrams illustrate sections of the hundreds of transfers executed after the breach.

Bitget announced its detection of unauthorized transfers at 18:31 UTC on Sept. 24 from segments of its hot and warm wallet infrastructure. The exchange later adjusted its loss estimation from $351.6 million to $387.5 million after factoring in additional Zcash and Tron transfers.

According to CEO Gracy Chen’s initial report, the attacker compromised a critical backend system, altered transaction data, and initiated the authorization process. Bitget asserted that cold wallets and private keys were not compromised.

Following its investigation, the exchange discovered a flaw in a third-party security solution that enabled attackers to gain credentials and fabricate withdrawal commands, as indicated in its findings. Bitget credited Mandiant and SlowMist among the firms aiding in forensic analysis and tracking.

While Chainalysis attributes the theft to North Korean actors, Chen’s initial evaluation was more reserved. She noted IP behavior and VPN infrastructure typical of known North Korean hacking operations without attributing blame at that early stage.

THORChain declined Bitget’s request to block attacker addresses

As previously reported by crypto.news, Chen attempted to prevent attacker addresses from utilizing THORChain following the movement of stolen funds through the protocol. However, THORChain refused to implement selective blocking, arguing that its emergency controls are designed to protect network security rather than freeze individual wallets.

Chen maintained that decentralization should not serve as a shield for services that facilitate known stolen funds. THORChain contended that temporarily pausing its network during a security event is not the same as denying service to specific addresses.

Security firm GoPlus questioned the protocol’s comparison with Bitcoin and Ethereum, highlighting its validator-controlled vaults and signing system. GoPlus suggested that such features grant THORChain’s operators levels of authority distinct from validators on foundational blockchains.

From the issuer perspective, earlier reports indicated that Circle and Tether collectively froze approximately $318,000 in USDC and USDT linked to the breach by Sept. 26.

Under Bitget’s recovery terms, qualified assistance that results in freezing of funds can earn a 5% bounty, while successful recuperation yields a separate 5% reward.

Bitget resumed withdrawals as U.S. authorities pursued distinct DPRK proceeds

In an update on Sept. 30, Bitget confirmed the restoration of major asset withdrawals, with Bitcoin returning on Sept. 28, Ether on Sept. 29, and USDT on Sept. 30. The exchange scheduled the return of remaining token, fiat, and P2P withdrawals for Oct. 2 at 08:00 UTC.

Chen also mentioned that the Protection Fund had returned over $300 million. Bitget’s reserve snapshot on Sept. 29 reported a 131% overall ratio across 19 covered assets, with each exceeding 100%, while asserting that customer balances remained unaffected.

In a separate U.S. case reported on Sept. 8, a federal court ordered the forfeiture of roughly $212,700 in stablecoins linked to wages earned by North Korean IT workers. Prosecutors claimed these workers concealed their identities, secured overseas jobs, and funneled their earnings through cryptocurrency.

The Justice Department’s complaint from June 2025 alleged that unsuspecting employers, including blockchain firms, often compensated these workers in USDC or USDT. Prosecutors detailed laundering activities through token swaps, transactions between blockchains, fake identity accounts, and smaller transfers.

Judge Rudolph Contreras granted forfeiture for the identified wallet but denied the request covering other assets without prejudice, as prosecutors had not sufficiently identified those assets in their public notice.