Bitget Hack: How AI Helped in Tracing $387 Million Across Chains

The Bitget hack didn’t stay on one blockchain for long. After $387 million was stolen on September 24, Chainalysis investigators used in-house AI and custom automation to track the funds across multiple networks and protocols.

The speed mattered. Investigators estimate more than 20 hours of manual bridge reconciliation was compressed into under 10 minutes. Hundreds of transfers followed the attack, with funds moving between networks including Ethereum and Bitcoin.

Bitget Hack Investigation Tracks Four Chains

During the first three hours, the stolen funds left Bitget across 23 transfers and reached four chains. Ethereum accounted for 49.7%, $XRP 40.8%, Zcash 7.6%, and Tron 1.8%.

From there, investigators identified several laundering mechanisms, including cross-chain liquidity protocols, messaging protocols, instant swaps and laundering services. The stolen $XRP created a particularly messy trail.

Cross-Chain Moves Made Tracking Much Harder

Instead of sending the $XRP directly to an exchange, the attackers moved it through a cross-chain liquidity protocol and received Bitcoin on another network. That sounds complicated. The blockchain record still remained.

Investigators matched deposits with corresponding payouts, connecting activity that appeared separate across different chains. Tens of millions of dollars moved through this mechanism over roughly a day and a half before reaching attacker-controlled addresses.

AI Accelerated The Investigation, Not Replaced It

Chainalysis said its usage of AI didn’t replace investigators. Instead, experts defined the logic, reviewed outputs and directed the investigation while automation handled repetitive tracing work.

Within minutes of identifying the stolen funds, labels were live on its data platform for compliance teams and law enforcement partners.

The attack, attributed by Chainalysis to North Korean actors, pushed crypto stolen by such actors in 2026 past $1 billion. The Bitget hack investigation continues as teams monitor linked addresses and follow the funds across chains.