BTC $84,845 
ETH $2,682 
USDT $0.9999 
BNB $771.74 
XRP $1.49 
USDC $1.0000 
SOL $119.55 
TRX $0.3356 
FIGR_HELOC $1.05 
ZEC $1,307 Chainalysis AI cuts Bitget hack bridge tracing from 20 hours to under 10 minutes
Chainalysis says its in-house AI matched cross-chain bridge deposits and payouts in under 10 minutes, a task it says took more than 20 hours by hand.
Key takeaways
- Under 10 minutes. Chainalysis says its AI cut more than 20 hours of manual bridge reconciliation to under 10 minutes.
- 23 transfers, four chains. About $387 million left Bitget in 23 transfers across Ethereum, XRP, Zcash and Tron.
- North Korea past $1 billion. Chainalysis attributes the attack to North Korean actors, pushing their 2026 theft above $1 billion.
What happened
Chainalysis says its in-house AI reduced more than 20 hours of manual bridge reconciliation to under 10 minutes during its trace of the $387 million taken from Bitget. In its Oct. 1 report, the firm said investigators built custom automation to link transactions across blockchains after the Sept. 24 breach.
Bitget said it detected unauthorized transfers at 18:31 UTC on Sept. 24 from parts of its hot and warm wallet infrastructure. Cold wallets were untouched. In CEO Gracy Chen's initial account, the attacker broke into a critical backend system, altered transaction data and set off the authorization process.
In the first three hours, Chainalysis counted 23 transfers that moved about $387 million out of Bitget. Ethereum accounted for 49.7% of the total, XRP 40.8%, Zcash 7.6% and Tron 1.8%.
Investigators followed the stolen XRP through cross-chain swaps into Bitcoin addresses the attackers controlled. The report says tens of millions of dollars moved through that route over roughly a day and a half.
Why it matters
Chainalysis attributes the attack to North Korean actors and says their 2026 theft now tops $1 billion. A G7 warning had already flagged that stolen funds were flowing into nuclear development programs.
Chainalysis says the AI handled the matching while its investigators ran the case. As the report put it: "Our investigators still defined the logic, reviewed the outputs, and directed the investigation." New labels on identified addresses went live to compliance teams and law enforcement in near-real time.
Bitget has offered 5% rewards for qualifying help to freeze and recover the stolen funds. When the hacker began swapping Ethereum for Bitcoin, CEO Chen publicly asked THORChain to freeze the routed funds. THORChain declined.
What the data shows
- In the first three hours, 23 transfers moved about $387 million out of Bitget.
- Ethereum took 49.7% of the outflow, XRP 40.8%, Zcash 7.6% and Tron 1.8%.
- Over $157 million in XRP was the largest single-asset slice.
- Bitget first pegged losses at $351.6 million, then revised the figure to $387.5 million.
- The revision reflected Zcash and TRON balances, not further theft after containment.
- Bitget offered 5% rewards for qualifying help freezing and recovering stolen funds.
What is still unclear
- Attribution is still being firmed up.
- The reported time saving concerned matching bridge deposits with payouts, one part of an investigation involving Bitget and law enforcement partners.
- The firm says it will keep monitoring the identified destinations and label more addresses as the funds move.
Questions readers ask
How much was stolen in the Bitget hack?
Bitget initially pegged losses at $351.6 million before a fuller accounting revised the figure to $387.5 million. The revision reflected Zcash and TRON balances, not further theft after containment.
How fast did Chainalysis trace the Bitget hack?
Chainalysis says its in-house AI cut more than 20 hours of manual bridge reconciliation to under 10 minutes. The firm says its investigators still defined the logic and reviewed the outputs.
Who does Chainalysis blame for the Bitget hack?
The firm attributes the September 24, 2026 breach to DPRK-linked actors and says the incident pushes North Korea's crypto theft in 2026 past $1 billion. Attribution is still being firmed up.
Were Bitget's cold wallets affected?
Cold wallets were untouched, according to the reports. Bitget said it detected unauthorized transfers at 18:31 UTC on Sept. 24 from parts of its hot and warm wallet infrastructure.
