Chainalysis AI Traces $387M Bitget Hack in Under 10 Minutes

Blockchain analytics firm Chainalysis says its artificial intelligence tools dramatically accelerated the investigation into the $387 million Bitget hack, reducing more than 20 hours of manual cross-chain reconciliation to less than 10 minutes.

The September 24, 2026 breach has been linked by Chainalysis to North Korean actors and pushed DPRK-attributed cryptocurrency theft above $1 billion this year. Human investigators remained responsible for directing the investigation, while AI automated the complex process of matching transactions across blockchain bridges and protocols.

Bitget detected unauthorized transfers from its hot and warm wallets at 18:31 UTC, while its cold wallets remained secure. CEO Gracy Chen said attackers compromised a critical backend system, manipulated transaction data and triggered the exchange's authorization process.

Initial estimates placed losses at $351.6 million, but the figure was later revised to roughly $387.5 million after Zcash and TRON holdings were included.

Chainalysis found that about $387 million was transferred through 23 transactions over three hours. Ethereum accounted for 49.7% of the stolen assets, followed by XRP at 40.8%, Zcash at 7.6% and Tron at 1.8%.

More than $157 million in XRP represented the largest single-asset portion. Investigators traced stolen XRP through cross-chain liquidity infrastructure, where it was converted into Bitcoin. Tens of millions of dollars eventually reached attacker-controlled Bitcoin addresses.

Chainalysis used custom AI-powered automations and more than a decade of cross-chain attribution data to match deposits with payouts across protocols. Address labels were then distributed to compliance teams and law enforcement in near-real time.

The faster process is significant because hackers can rapidly move stolen crypto through bridges, decentralized exchanges, instant swaps and laundering services, leaving exchanges and stablecoin issuers with limited time to freeze assets.

However, Chainalysis stressed that faster tracing does not automatically recover stolen funds. Attribution also remains under investigation, although IP addresses, VPN activity and transaction patterns have shown similarities to Lazarus Group operations.

Authorities and industry participants continue monitoring identified wallets, while exchange alerts, law-enforcement coordination and Bitget's 5% recovery bounty remain key options for recovering the stolen cryptocurrency.