Bitget Hackers Leave Trail of Crypto Across Multiple Networks

A $387 million heist at Bitget on September 24 was quickly followed by an investigation that used in-house AI and custom automation to track the stolen funds across multiple networks. Chainalysis investigators estimate they compressed over 20 hours of manual bridge reconciliation into under 10 minutes, a speed that mattered greatly in this case. The stolen funds moved between Ethereum and Bitcoin as well as XRP, Zcash, and Tron.

The attackers used various laundering mechanisms to obscure the trail, including cross-chain liquidity protocols, messaging protocols, instant swaps, and laundering services. This added complexity made tracking much harder, but Chainalysis was able to match deposits with corresponding payouts and connect activity across different chains. The stolen XRP created a particularly messy trail.

The AI used in this investigation did not replace human investigators, but rather worked alongside them to accelerate the process. Within minutes of identifying the stolen funds, labels were live on Chainalysis' data platform for compliance teams and law enforcement partners. This attack has pushed crypto stolen by North Korean actors past $1 billion in 2026.