Law-enforcement organization, substitute alerts, and the 5% bounty for voluntary recovery persist the transparent recovery levers. The AI handled cross-chain matching at a speed that changes the recovery window for exchanges, issuers, and law enforcement.
$387 Million Left in 23 Transfers, Here Is How the Finance Moved
At 18:31 UTC on September 24, Bitget detected unauthorized transfers from its hot and warm wallets. THORChain declined.
That left cross-chain bridges, instantaneous swaps, DEXs, and laundering services as the central movement channels, exactly the type of multi-hop trail where manual reconciliation breaks down.
What the AI Did, and What It Could Not Do
Chainalysis built custom automations that matched deposits and payouts across protocols, drawing on further than a decade of cross-chain attribution figures.
The result: Bitget hack-linked bridge hops that would have taken a unit extra than 20 hours to map by hand were resolved in under 10 minutes.
Labels on identified addresses were pushed live to compliance teams and law enforcement in close to-genuine time.
Speed matters as DPRK-linked operators advance capital speedy.
The little Circle and Tether freezes cited when Bitget began restoring withdrawals in phases showed how limited that freeze window is.
A sub-10-minute reconcile does not recover the capital by itself.
But it shortens the gap in the middle of outflow and field-large labeling, which is where most share-hack recovery lives.
The broader Bitget hack background is worth noting: a G7 warning on North Korea’s crypto theft machine had already flagged that stolen money were flowing into nuclear development programs.
The Chainalysis finding pushes 2026 DPRK-attributed theft past $1 billion, and adds an AI-speed dimension to what was already a systemic exposure conversation.
Attribution is still being firmed up. The revision reflected Zcash and TRON balances, not further theft later than containment.
Chainalysis says $387 million exited in 23 transfers across three hours, landing on four chains: Ethereum took 49.7%, XRP 40.8%, Zcash 7.6%, and Tron 1.8%.
Over $157 million in XRP was identified as the largest individual-resource slice, together with initial on-chain information flagging Lazarus-approach operation in the routing patterns.
From there, stolen XRP was pushed by route of a cross-chain liquidity protocol and received as Bitcoin, including tens of millions traced over regarding 36 hours to attacker-controlled Bitcoin addresses.
When Bitget’s hacker began swapping Ethereum for Bitcoin, CEO Chen publicly asked THORChain to freeze the routed resources. Cold wallets were untouched.
CEO Gracy Chen later said the attacker compromised a essential backend mechanism, spoofed secure facts, and triggered the authorization consider.
That account of the Bitget hack initially pegged losses at $351.6 million earlier than a fuller accounting revised the figure to $387.5 million.
Blockchain analytics firm Chainalysis says its in-house AI compressed over 20 hours of manual bridge reconciliation to under 10 minutes whereas tracing the Bitget hack.
The firm attributes the September 24, 2026 breach to DPRK-linked actors and says the incident pushes North Korea’s crypto theft in 2026 past $1 billion.
Investigators, not the model, directed the case. Chen flagged IP and VPN patterns uniform including Lazarus-manner task at the time of the breach but stopped compact of confirming it.
Blockchain analytics platforms like Chainalysis Reactor now push clustered tackle labels as portion of their benchmark inquiry workflow.
The Bitget hack is the primary important evaluate of how rapid that workflow can advance when AI compresses the bridge-reconciliation layer.
Monitoring of the identified addresses is current.
Source: Chainalysis AI Compresses $387M Bitget Trace From 20 Hours of Bridge Work to Under 10 Minutes
