Blockchain analytics firm Chainalysis reported that its in-house artificial intelligence tool compressed more than 20 hours of manual bridge reconciliation into under 10 minutes while tracking the recent Bitget security breach.
The incident, which occurred on September 24, 2026, involved unauthorized transfers from Bitget hot and warm wallets while cold wallets remained untouched. Bitget CEO Gracy Chen stated that the attacker compromised a critical backend system, spoofed transaction data, and triggered the authorization process. Initial loss estimates of $351.6 million were later revised to $387.5 million to account for Zcash and TRON balances.
According to Chainalysis, $387 million left the platform in 23 transfers across three hours and was distributed across four chains: Ethereum accounted for 49.7%, XRP for 40.8%, Zcash for 7.6%, and TRON for 1.8%. Over $157 million in XRP represented the largest single-asset portion, with routing patterns displaying Lazarus-style activity. Stolen XRP was moved through a cross-chain liquidity protocol and converted into Bitcoin, with tens of millions traced to attacker-controlled Bitcoin addresses over approximately 36 hours.
During the incident, CEO Chen publicly requested that THORChain freeze the routed funds, though THORChain declined. This left cross-chain bridges, instant swaps, decentralized exchanges, and laundering services as the primary movement channels.
Chainalysis deployed custom automations utilizing historical cross-chain attribution data to match deposits and payouts across protocols. While human investigators directed the case, the AI handled cross-chain matching rapidly, resolving bridge hops that typically required over 20 hours of manual mapping in less than 10 minutes. Identified address labels were shared with compliance teams and law enforcement in near-real time.
The analytics firm attributes the breach to Democratic People's Republic of Korea (DPRK)-linked actors, pushing total DPRK-attributed crypto theft for 2026 past $1 billion. While attribution work continues and Bitget has offered a 5% bounty for voluntary recovery, monitoring of the identified addresses and law enforcement coordination remain ongoing.
