Bitget Hack: Chainalysis Used Custom AI Automation to Trace $387M Across Multiple Blockchains

September 24 moved rapidly across chains. Chainalysis investigators used in-house AI-powered automation and custom tooling to follow $387 million as it left exchange wallets and passed through bridges, swaps, liquidity protocols and other services.

Within hours of the breach the funds were distributed in 23 transfers and reached four blockchains: Ethereum, XRP, Zcash and Tron. Ethereum made up 49.7% of the flow, XRP 40.8%, Zcash 7.6% and Tron 1.8%. That cross-chain behavior complicated tracking because attackers converted and routed assets through services that create separate records on different ledgers.

Chainalysis describes its AI usage as a force multiplier for investigators, not a replacement. Automation handled repetitive reconciliation tasks and rapid matching of cross-chain deposits and withdrawals. Human analysts set the logic, reviewed automated findings and guided follow-up. As a result, labels indicating the stolen funds appeared within minutes on Chainalysis's data platform, making that information available to compliance teams and law enforcement partners sooner.

Speed mattered. The firm estimates that more than 20 hours of manual bridge reconciliation were compressed into under 10 minutes by its custom automation. That allowed investigators to trace hundreds of transfers that unfolded over roughly a day and a half and to keep monitoring linked addresses as funds moved through additional services, including instant swaps and messaging protocols.

The investigation also highlighted laundering patterns. Tens of millions of dollars moved through cross-chain liquidity and other mixing techniques before consolidating into attacker-controlled addresses. Chainalysis identified multiple laundering mechanisms across the traced flows, including swaps and services designed to obscure provenance.

Chainalysis attributed the attack to North Korean actors in its reporting. The firm noted the broader context that cryptocurrency thefts by such actors have pushed total stolen crypto linked to them past $1 billion in 2026. Chainalysis continues to monitor addresses linked to the Bitget incident and to follow funds as they traverse additional chains and services.

Other security firms and trackers published related analyses with partially overlapping findings. Some traced similar routes into Bitcoin and CoinJoin transactions, while others documented freezing actions by token issuers and the fraction of stolen assets publicly frozen in the days after the breach.

The Bitget incident illustrates two practical points for defenders and compliance teams: cross-chain services complicate forensic timelines, and automation that pairs analyst-defined logic with rapid reconciliation can materially reduce time-to-label and help route intelligence to law enforcement faster. For exchanges and token issuers, the case also shows how quickly attackers can move value across multiple networks and the limited scope of early freezing actions relative to total stolen amounts.