Chainalysis AI slashes Bitget hack investigation time to ten minutes

The forensic breakthrough relied on custom-built automation designed to bridge the gap between fragmented transaction trails across four distinct blockchains. By defining specific matching logic, investigators enabled the AI to connect deposits on one network directly to payouts on another, reconstructing activity that appeared disparate when viewed in isolation. This allowed for the near-instantaneous labeling of addresses controlled by the attackers, which were then pushed to compliance teams via the firm’s data platform.

Following the breach, the stolen assets—comprising 49.7% Ethereum, 40.8% XRP, 7.6% Zcash, and 1.8% Tron—were moved through a series of liquidity protocols and instant-swap services. In one instance, the team traced XRP transfers that were funneled through a liquidity protocol to exit as Bitcoin, bypassing direct exchange deposits. While Chainalysis directed the technical investigation, the firm emphasized that its AI acted solely as a force multiplier for human oversight, with investigators maintaining control over all final outputs and pursuit decisions.

Bitget CEO Gracy Chen confirmed that the hack originated from a compromised third-party security product, allowing attackers to forge withdrawal commands while leaving cold wallets untouched. Despite the exchange's efforts to coordinate a cross-chain freeze, decentralized protocols such as THORChain resisted requests to blacklist specific addresses. Bitget has since restored major asset withdrawals and maintains that its protection fund remains above $300 million to cover the losses.