Chainalysis used in-house AI and custom automation to trace $387 million stolen from Bitget across four blockchains. Investigators estimate the tools cut over 20 hours of manual bridge reconciliation to under 10 minutes, while experts still defined the logic and directed the investigation.
Chainalysis investigators traced $387 million stolen from Bitget across multiple networks and protocols after the theft on September 24. The firm's in-house AI and custom automation compressed what investigators estimate would normally take more than 20 hours of manual bridge reconciliation into under 10 minutes. Hundreds of transfers followed the attack, moving funds between networks including Ethereum and Bitcoin.
Stolen Funds Spread Across Four Chains Within Hours
In the first three hours, the stolen funds left Bitget across 23 transfers and reached four chains. Ethereum accounted for 49.7% of the funds, XRP for 40.8%, Zcash for 7.6%, and Tron for 1.8%. From there, investigators identified several laundering mechanisms, including cross-chain liquidity protocols, messaging protocols, instant swaps, and laundering services. The stolen XRP created a particularly messy trail.
Cross-Chain Routing Complicated the Trace
Instead of sending the XRP directly to an exchange, the attackers moved it through a cross-chain liquidity protocol and received Bitcoin on another network. The blockchain record still remained, however, so investigators matched deposits with corresponding payouts, connecting activity that appeared separate across different chains. Tens of millions of dollars moved through this mechanism over roughly a day and a half before reaching attacker-controlled addresses.
AI Sped Up the Work, Investigators Still Led It
Chainalysis said its use of AI did not replace investigators. Instead, experts defined the logic, reviewed outputs, and directed the investigation while automation handled repetitive tracing work. Within minutes of identifying the stolen funds, labels were live on its data platform for compliance teams and law enforcement partners.
The attack, which Chainalysis attributed to North Korean actors, pushed crypto stolen by such actors in 2026 past $1 billion. Investigators continue to monitor linked addresses as they follow the funds across chains.
Source: Chainalysis
Trading involves risk.
Risk Disclaimer
