AI accelerates Bitget theft investigation

Chainalysis deploys in-house AI to accelerate Bitget investigation

• Following the September 24 theft of $387 million from Bitget, Chainalysis investigators collaborated with the exchange and law enforcement to track stolen assets across four blockchain networks.
• Custom automation built with proprietary AI reduced bridge reconciliation from over 20 hours to fewer than 10 minutes, enabling rapid identification of laundering pathways and cross-chain movement.
• North Korea-attributed actors now account for more than $1 billion stolen in 2026; ongoing monitoring and address labelling will support interdiction efforts in coming weeks.

The theft disclosed by Bitget last week set off a round-the-clock response inside Chainalysis. Investigators knew the DPRK-attributed actors would disperse the $387 million quickly, so the Customer Outcomes team turned to proprietary AI to build bespoke automation matching that velocity. Manual reconciliation of bridge transactions—work that would ordinarily consume more than 20 hours—was compressed to under 10 minutes, freeing analysts to focus on interpreting complex flows and directing the next phase of tracing.

Throughout the operation, Chainalysis maintained continuous communication with Bitget and law enforcement partners, sharing intelligence derived from the evolving on-chain picture. Hundreds of transfers have already occurred, with funds hopping between Ethereum, XRP, Zcash, Tron and ultimately Bitcoin. The graph of transactions reveals a sprawling web of hops across protocols, each requiring reconciliation to preserve the investigative thread.

Bespoke tooling built on agentic platform

The automation deployed was not a generic graph-building assistant. Chainalysis investigators used an agentic platform that interrogates both internal and external data sources, enabling rapid development of solutions tailored to the specific characteristics of this case. Experts retained full control: they defined the reconciliation logic, reviewed every output, and made all strategic decisions about where to probe next. What changed was the elimination of repetitive manual tasks that would otherwise have slowed the pace of discovery.

Speed matters because sophisticated threat actors—especially those linked to North Korea—now deploy their own automation to fragment and obfuscate stolen funds across multiple chains and protocols. Keeping pace demands tools that accelerate the mechanical work without sacrificing the judgment required to interpret ambiguous on-chain patterns. Within minutes of identifying tainted addresses, Chainalysis had live labels in its data platform, giving compliance teams and law enforcement actionable intelligence.

Mapping the initial dispersion and subsequent laundering

In the three hours immediately following the exploit, 23 transfers moved the entire $387 million onto four chains. Ethereum received 49.7 per cent, XRP 40.8 per cent, Zcash 7.6 per cent, and Tron 1.8 per cent. From those landing points, investigators identified a range of obfuscation techniques: cross-chain liquidity protocols, instant swap services, and connections to established laundering infrastructure.

The XRP portion presented a particularly instructive challenge. Rather than cashing out at an exchange, the attackers routed it through a cross-chain liquidity protocol and withdrew Bitcoin on the far side. Such protocols allow a user to deposit one asset on one chain and receive a different asset on another, with no account linking the two legs. Each swap nonetheless leaves a record, and Chainalysis investigators matched inbound deposits to their corresponding outbound payouts, reconstructing the bridge that the attackers assumed would break the trail.

Over roughly 36 hours, tens of millions of dollars flowed through this mechanism. Investigators followed the resulting Bitcoin to attacker-controlled addresses, then continued tracing through subsequent hops involving additional protocols. The work relied on more than a decade of cross-chain attribution data that Chainalysis has accumulated, connecting activity across services that would otherwise appear unrelated. A condensed visualisation of one segment shows funds passing through bridges, mixers and decentralised exchanges in rapid succession.

Ongoing monitoring and intelligence sharing

The investigation remains active. In the weeks ahead, Chainalysis will continue using the custom tooling to track fund movements, label newly identified addresses, and coordinate with exchanges, stablecoin issuers and law enforcement. The aim is to support efforts to freeze or block assets before they can be liquidated or moved beyond reach.

Labels flagging stolen funds now populate the Chainalysis platform, giving partner institutions visibility into any interaction with tainted addresses. This intelligence layer is designed to enable real-time interdiction: compliance teams can screen transactions against updated labels, and investigators can pivot quickly when funds surface at a monitored service.

The Bitget theft also underscores a broader trend. North Korea-attributed actors have now stolen more than $1 billion in cryptocurrency during 2026, and their operational tempo shows no sign of slowing. The attackers demonstrated familiarity with cross-chain protocols and moved funds across Ethereum, XRP, Zcash and Tron within hours, then employed liquidity bridges to convert XRP into Bitcoin without touching a centralised exchange. Each step required investigators to reconcile deposits and withdrawals across distinct ledgers—work that would have been prohibitively slow without automation.

Human expertise remained central throughout. Investigators defined the parameters for matching bridge transactions, reviewed the results for anomalies, and decided which leads to pursue. The AI handled the repetitive interrogation of transaction logs and the assembly of candidate matches; analysts interpreted those candidates and extended the investigation into new protocols and address clusters. The division of labour allowed the team to maintain pace with adversaries who were themselves using automation to fragment and disperse the stolen funds.

Cross-chain attribution data proved essential. Chainalysis has spent years building the connective tissue that links deposits on one chain to withdrawals on another, even when no explicit identifier joins them. In this case, that infrastructure enabled investigators to follow XRP into a liquidity protocol and pick up the trail when Bitcoin emerged on the other side. Without it, the thread would have gone cold at the protocol boundary.

The investigation also highlighted the value of real-time labelling. Within minutes of confirming that an address held stolen funds, Chainalysis added a label visible to all platform users. Exchanges running transaction-monitoring systems that ingest Chainalysis data could immediately flag any deposit or withdrawal touching those addresses, creating opportunities to freeze assets or gather additional evidence. The speed of labelling directly affects the window available for interdiction, and automation made that speed possible.

Looking forward, the tooling developed for this case offers a preview of evolving investigative capabilities. The ability to spin up custom automation for a specific threat actor or laundering technique means investigators can adapt quickly as adversaries shift tactics. North Korea-attributed groups have shown a willingness to experiment with new protocols and chains; matching that adaptability requires both deep domain knowledge and tools that can scale across multiple ledgers without manual bottlenecks.

Chainalysis will continue refining the automation and expanding the scope of monitored addresses as the Bitget funds move through additional hops. Collaboration with exchanges and law enforcement remains ongoing, and any intelligence developed will be shared with relevant counterparts. The goal is to shrink the window in which stolen funds can be liquidated and to build a more complete picture of the infrastructure supporting large-scale cryptocurrency theft.