Key Insights
- Bitget hack investigators used artificial intelligence tools to compress over 20 hours of bridge reconciliation into under 10 minutes.
- Chainalysis attributed the $387 million Sept. 24 theft to North Korea-linked actors.
- The stolen assets initially moved across Ethereum, XRP, Zcash and Tron before investigators followed cross-chain routes.
Investigators tracing the Bitget hack used artificial intelligence-assisted automation to cut a manual blockchain task from over 20 hours to under 10 minutes, according to Chainalysis.
The blockchain analytics company published new details on Oct. 1 about its work following the $387 million theft. The disclosure shifts attention from the breach itself toward how investigators tracked assets across several networks.
Bitget Hack Funds Moved Across Four Chains
Chainalysis said $387 million left Bitget through 23 transfers during the first three hours after the Sept. 24 exploit.
Ethereum received 49.7% of the initial stolen value. XRP accounted for 40.8%, Zcash 7.6% and Tron 1.8%, according to the firm’s investigation.
Fusion Market News previously reported the early Bitget hack estimates and North Korea suspicions. Chainalysis later put the total at $387 million and attributed the attack to Democratic People’s Republic of Korea-linked actors.
The firm said the theft pushed North Korea-linked crypto theft above $1 billion during 2026. Chainalysis continues to monitor addresses connected to the stolen assets.
AI Speeds Cross-Chain Reconciliation
The new angle centers on the investigative workload. Chainalysis said its team built custom automation using in-house artificial intelligence while tracing the stolen funds.
One task involved matching deposits and payouts through cross-chain infrastructure. The firm estimated that automation compressed more than 20 hours of manual bridge reconciliation into under 10 minutes.
Investigators still directed the analysis and interpreted the results. The artificial intelligence tooling automated repetitive reconciliation rather than replacing the underlying blockchain attribution work.
The XRP trail illustrated the problem. Chainalysis said attackers moved stolen XRP through a cross-chain liquidity protocol and received Bitcoin on another network instead of sending the XRP directly to a centralized exchange.
Investigators matched those transactions and followed later movements to attacker-controlled Bitcoin addresses. Chainalysis said tens of millions of dollars moved through that route over roughly a day and a half.
Bitget Hack Shows Cross-Chain Tracing Pressure
The Bitget hack shows why investigators increasingly track activity across several blockchains at once. Attackers can split funds, swap assets and cross networks before compliance teams complete manual reconciliation.
Automation can narrow that timing gap, but attribution still depends on reliable address labels and transaction data. Chainalysis said its tooling operated on top of cross-chain attribution data built over years.
The investigation remains active. Chainalysis said it plans to keep labeling linked addresses and sharing intelligence with Bitget and law-enforcement partners.
That leaves recovery as the next test. Faster tracing can identify where stolen assets move, but it does not by itself guarantee that exchanges, issuers or authorities can freeze and recover them.
Sharron Kendi
Sharron Kendi is a seasoned crypto market analyst and writer with over three years of experience decoding blockchain trends, price movements, and market dynamics. She holds a Bachelor’s Degree in Commerce (Finance) from Kenyatta University, blending a solid academic foundation with a sharp eye for technical analysis and a deep understanding of on-chain data. Her work delivers clear, data-driven insights that empower investors to navigate the fast-evolving digital asset space with confidence.
