Chainalysis AI Compresses $387M Bitget Trace From 20 Hours of Bridge Work to Under 10 Minutes

HIGHLIGHTS Chainalysis says its in-house AI compressed 20+ hours of manual bridge reconciliation to under 10 minutes while tracing the Bitget hack. The $387.5M breach saw funds exit in 23 transfers across four chains, Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%). The firm attributes the September 24 hack to DPRK-linked actors, pushing North Korea's 2026 crypto theft past $1 billion. Blockchain analytics firm Chainalysis says its in-house AI compressed over 20 hours of manual bridge reconciliation to under 10 minutes while tracing the Bitget hack.

The firm attributes the September 24, 2026 breach to DPRK-linked actors and says the incident pushes North Korea’s crypto theft in 2026 past $1 billion.

Investigators, not the model, directed the case. The AI handled cross-chain matching at a speed that changes the recovery window for exchanges, issuers, and law enforcement.
$387 Million Left in 23 Transfers, Here Is How the Money Moved
At 18:31 UTC on September 24, Bitget detected unauthorized transfers from its hot and warm wallets. Cold wallets were untouched.

CEO Gracy Chen later said the attacker compromised a critical backend system, spoofed transaction data, and triggered the authorization process.

That account of the Bitget hack initially pegged losses at $351.6 million before a fuller accounting revised the figure to $387.5 million. The revision reflected Zcash and TRON balances, not further theft after containment.

Chainalysis says $387 million exited in 23 transfers across three hours, landing on four chains: Ethereum took 49.7%, XRP 40.8%, Zcash 7.6%, and Tron 1.8%.

Over $157 million in XRP was identified as the largest single-asset slice, with early on-chain data flagging Lazarus-style activity in the routing patterns.

From there, stolen XRP was pushed through a cross-chain liquidity protocol and received as Bitcoin, with tens of millions traced over roughly 36 hours to attacker-controlled Bitcoin addresses.

When Bitget’s hacker began swapping Ethereum for Bitcoin, CEO Chen publicly asked THORChain to freeze the routed funds. THORChain declined.

That left cross-chain bridges, instant swaps, DEXs, and laundering services as the primary movement channels, exactly the kind of multi-hop trail where manual reconciliation breaks down.
What the AI Did, and What It Could Not Do
Chainalysis built custom automations that matched deposits and payouts across protocols, drawing on more than a decade of cross-chain attribution data.

The result: Bitget hack-linked bridge hops that would have taken a team more than 20 hours to map by hand were resolved in under 10 minutes.

Labels on identified addresses were pushed live to compliance teams and law enforcement in near-real time.

Speed matters because DPRK-linked operators move funds fast.

The small Circle and Tether freezes cited when Bitget began restoring withdrawals in phases showed how narrow that freeze window is.

A sub-10-minute reconcile does not recover the money by itself.

But it shortens the gap between outflow and industry-wide labeling, which is where most post-hack recovery lives.

The broader Bitget hack context is worth noting: a G7 warning on North Korea’s crypto theft machine had already flagged that stolen funds were flowing into nuclear development programs.

The Chainalysis finding pushes 2026 DPRK-attributed theft past $1 billion, and adds an AI-speed dimension to what was already a systemic risk conversation.

Attribution is still being firmed up. Chen flagged IP and VPN patterns consistent with Lazarus-style activity at the time of the breach but stopped short of confirming it.

Blockchain analytics platforms like Chainalysis Reactor now push clustered address labels as part of their standard investigation workflow.

The Bitget hack is the first major test of how fast that workflow can move when AI compresses the bridge-reconciliation layer.

Monitoring of the identified addresses is ongoing. Law-enforcement coordination, exchange alerts, and the 5% bounty for voluntary recovery remain the open recovery levers.