Blockchain analytics company Chainalysis says it used artificial intelligence to trace money linked to the Bitget hack much faster than would have been possible through manual work.
According to the company, a job that could have taken investigators more than 20 hours was completed in less than 10 minutes. Chainalysis linked the September 24 attack to North Korea-linked hackers and said crypto theft attributed to the country has now crossed $1 billion in 2026.
1/ What happens when North Korea steals $387M in crypto and starts laundering it at machine speed?
We put that question to the test after the September 24 Bitget theft.
Here’s what our investigators found 🧵 https://t.co/dhUlOqnPGB
— Chainalysis (@chainalysis) October 2, 2026
Bitget detected unauthorized transfers from its hot and warm wallets at about 18:31 UTC on September 24. Its cold wallets were not affected.
Bitget CEO Gracy Chen later said the attacker had gained access to an important backend system, manipulated transaction information and triggered the normal authorization process.
The initial estimate of the stolen amount was about $351.6 million. It was later revised to around $387.5 million after Zcash and TRON holdings were included in the calculation.
Chainalysis said the stolen funds left Bitget in 23 transfers over about three hours. The money moved across four networks. Ethereum accounted for 49.7% of the amount, XRP for 40.8%, Zcash for 7.6% and Tron for 1.8%.
More than $157 million worth of XRP was identified as the largest single portion of the stolen funds. The XRP was later moved through a cross-chain liquidity protocol and converted into Bitcoin.
This is where the investigation became more complicated. The attacker used bridges, instant swaps, decentralized exchanges and other services to move the funds between networks. Following such a trail manually can take a lot of time.
Chainalysis said it built custom AI-powered tools to match deposits and payouts across different protocols. The company used its existing cross-chain data and address attribution information to speed up the process.
According to Chainalysis, the bridge movements connected to the Bitget hack that would normally have taken more than 20 hours to reconcile were mapped in under 10 minutes.
The company also said labels for identified addresses could be shared with compliance teams and law enforcement almost immediately. That speed can matter a lot in a crypto theft because stolen funds can be moved several times before exchanges and other companies have time to react.
However, faster tracing does not automatically mean the stolen money can be recovered. It mainly gives exchanges, issuers and investigators a better chance of identifying and blocking funds before they move again. The investigation is still continuing, and the exact attribution of the attack is still being worked on.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment