Chainalysis AI traces $387M Bitget hack in under 10 minutes

cryptonews

44 mins ago

Chainalysis has used its in-house AI to cut more than 20 hours of manual bridge reconciliation to under 10 minutes while investigating the $387 million stolen from Bitget. Summary Chainalysis ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Most Discussed

{"basename":"","ssrTDKData":{"titleTemplate":"%s - Tiger Brokers","title":"Tiger Brokers HK | Online Trading in stocks, bonds & ETFS","description":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","keywords":"tiger trading,tiger security,tiger broker hk,tigers co ltd,tiger trade hk,tiger brokers hk,stock broker,securities broker,online brokerage,hong kong broker,hk broker,online stock trading,online trading platform,stock trading platforms,trading application,stock trading,stock trading hong kong,buying stocks in hong kong,tiger brokers","social":{"ogDescription":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","ogImage":"https://c1.itigergrowtha.com/portal5/static/media/og-logo.0a0bd8dc.png","ogUrl":"https://hk.tigershowtime.com/news/2672723762"},"companyName":"Tiger Brokers"},"pageData":{"isMobile":false,"isTiger":false,"isTTM":true,"region":"HKG","license":"TBHK","edition":"fundamental"},"isCrawlerRequest":true,"__swrFallback__":{"@#url:\"https://stock-news.skytigris.cn/v3/news\",params:#id:\"2672723762\",edition:\"fundamental\",auth_exemption:1,,,undefined,":{"share":"https://ttm.financial/m/news/2672723762?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-10-03 20:00","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2672723762","market":"fut","top_or_hot":-1,"title":"Chainalysis AI traces $387M Bitget hack in under 10 minutes","media":"cryptonews","content":"<div>\n<p>Chainalysis has used its in-house AI to cut more than 20 hours of manual bridge reconciliation to under 10 minutes while investigating the $387 million stolen from Bitget.\n\n\nSummary\n\n\n\nChainalysis ...</p>\n\n<a href=\"https://crypto.news/chainalysis-ai-traces-bitget-hack-in-10-minutes/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Chainalysis AI traces $387M Bitget hack in under 10 minutes</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nChainalysis AI traces $387M Bitget hack in under 10 minutes\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-03 20:00 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/chainalysis-ai-traces-bitget-hack-in-10-minutes/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Chainalysis has used its in-house AI to cut more than 20 hours of manual bridge reconciliation to under 10 minutes while investigating the $387 million stolen from Bitget.\n\n\nSummary\n\n\n\nChainalysis ...</p>\n\n<a href=\"https://crypto.news/chainalysis-ai-traces-bitget-hack-in-10-minutes/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BITW","symbol_name":"Bitwise 10 Crypto Index ETF","start_time":0,"source_url":"https://crypto.news/chainalysis-ai-traces-bitget-hack-in-10-minutes/","article_id":"2672723762","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/chainalysis-ai-traces-bitget-hack-in-10-minutes/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2672723762","pubTimestamp":1791028800,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Chainalysis has used its in-house AI to cut more than 20 hours of manual bridge reconciliation to under 10 minutes while investigating the $387 million stolen from Bitget.Chainalysis says AI accelerated cross-chain matching while investigators directed the work and reviewed results.The firm attributes the attack to North Korean actors, putting their 2026 theft above $1 billion.Investigators tracked stolen XRP through cross-chain swaps to Bitcoin addresses controlled by the attackers.Chainalysis AI matched transfers while investigators directed the case. In the stolen XRP trail, investigators identified transfers through a cross-chain liquidity protocol that paid out Bitcoin instead of sending the XRP directly to an exchange. According to the report, tens of millions of dollars passed through that route over roughly a day and a half.Within the first three hours of the attack, Chainalysis recorded 23 transfers carrying about $387 million out of Bitget. Its breakdown assigned 49.7% to Eth","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BITW":"Bitwise 10 Crypto Index ETF","QTOC":"Innovator Growth Accelerated Plus ETF - October","XRP":"Bitwise XRP ETF","CHAT":"ROUNDHILL GENERATIVE AI & TECHNOLOGY ETF","AGIX":"通用人工智能 ETF-AGIX","ARTY":"ISHARES FUTURE AI & TECH ETF","AIPO":"Defiance AI and Power Infrastructure ETF","VTHR":"Vanguard Russell 3000 ETF"},"translate_title":"Chainalysis AI 在 10 分钟内追踪 3.87 亿美元的 Bitget 黑客攻击","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"ARTY":1.5,"CHAT":1.5,"BITW":0.67,"AGIX":1.5,"VTHR":1.5,"QTOC":1.5,"XRP":0.77,"AIPO":1.5},"content_text":"Chainalysis has used its in-house AI to cut more than 20 hours of manual bridge reconciliation to under 10 minutes while investigating the $387 million stolen from Bitget.\n\n\nSummary\n\n\n\nChainalysis says AI accelerated cross-chain matching while investigators directed the work and reviewed results.\nThe firm attributes the attack to North Korean actors, putting their 2026 theft above $1 billion.\nInvestigators tracked stolen XRP through cross-chain swaps to Bitcoin addresses controlled by the attackers.\nBitget has offered separate 5% rewards for qualifying help freezing and recovering stolen funds.\n\n\n\nChainalysis said in its Oct. 1 report that investigators built custom automation to connect transactions across blockchains after the Sept. 24 breach. The reported time saving concerned matching bridge deposits with payouts, one part of an investigation involving Bitget and law enforcement partners.\nWorking around the clock, the firm’s investigation team used the tools to follow fragmented transaction trails and share findings with the exchange and authorities. According to the report, newly identified addresses received stolen-fund labels within minutes, making the information available to compliance teams through its data platform.\nChainalysis AI matched transfers while investigators directed the case\nUnder the process described by the firm, investigators set the matching rules, checked the results, and decided which leads to pursue. Its AI helped them build tools for the specific case rather than taking control of the investigation.\nAs the report put it:\n\n“Our investigators still defined the logic, reviewed the outputs, and directed the investigation.”\n\nDrawing on more than a decade of cross-chain attribution data, the automation connected deposits on one network with payments on another. The firm said the approach helped reconstruct activity that could otherwise appear unrelated when viewed on separate blockchains.\nIn the stolen XRP trail, investigators identified transfers through a cross-chain liquidity protocol that paid out Bitcoin instead of sending the XRP directly to an exchange. According to the report, tens of millions of dollars passed through that route over roughly a day and a half.\nAfter matching the deposits and payouts, investigators followed subsequent transactions through several protocols to attacker-controlled Bitcoin addresses, the firm said. Its team continues to monitor the identified destinations and plans to label additional addresses as the funds move.\nThe Bitget hack sent $387m across four chains\nWithin the first three hours of the attack, Chainalysis recorded 23 transfers carrying about $387 million out of Bitget. Its breakdown assigned 49.7% to Ethereum, 40.8% to XRP, 7.6% to Zcash and 1.8% to Tron.\nBeyond the initial withdrawals, the firm identified cross-chain liquidity and messaging protocols, instant-swap services and links to laundering services. Its published transaction graphs show portions of the hundreds of transfers made after the breach.\nBitget said its systems detected unauthorized transfers at 18:31 UTC on Sept. 24 from parts of its hot and warm wallet infrastructure. The exchange later raised its loss estimate from $351.6 million to $387.5 million after including additional Zcash and Tron transfers.\nAccording to CEO Gracy Chen’s initial account, the attacker compromised a critical backend system, manipulated transaction data, and triggered the authorization process. Bitget said cold wallets and private keys remained secure.\nThe exchange’s subsequent investigation identified a vulnerability in a third-party security product that allowed attackers to obtain credentials and forge withdrawal commands, according to its reported findings. Bitget named Mandiant and SlowMist among the firms assisting with forensic work and tracing.\nWhile Chainalysis attributes the theft to North Korean actors, Chen’s initial assessment was more cautious. She cited IP behavior and VPN infrastructure consistent with known North Korean hacking operations without confirming responsibility at that stage.\nTHORChain rejected Bitget’s request to block attacker addresses\nAs crypto.news previously reported, Chen sought to block attacker addresses from using THORChain after stolen funds began moving through the protocol. THORChain rejected selective blocking, arguing that its emergency controls protect network security rather than freeze individual wallets.\nChen argued that decentralization should not shield services facilitating known stolen funds. THORChain maintained that pausing its network during a security incident differs from denying service to particular addresses.\nSecurity firm GoPlus challenged the protocol’s comparison with Bitcoin and Ethereum, pointing to its validator-controlled vaults and signing system. According to GoPlus, those features give THORChain’s operators powers that differ from validators on the underlying blockchains.\nOn the issuer side, earlier reporting put Circle and Tether’s combined freezes at approximately $318,000 in USDC and USDT linked to the breach by Sept. 26.\nAccording to Bitget’s recovery terms, qualifying assistance that results in funds being frozen can earn a 5% bounty, while successful recovery carries a separate 5% reward.\nBitget restored withdrawals as U.S. authorities pursued separate DPRK proceeds\nIn its Sept. 30 update, Bitget confirmed it had restored major asset withdrawals, with Bitcoin returning on Sept. 28, Ether on Sept. 29 and USDT on Sept. 30. Its timetable scheduled remaining token, fiat and P2P withdrawals for Oct. 2 at 08:00 UTC.\nChen also said the Protection Fund had returned above $300 million. Bitget’s Sept. 29 reserve snapshot reported a 131% overall ratio across 19 covered assets, with each above 100%, while the exchange maintained that customer balances were unaffected.\nIn a separate U.S. case reported Sept. 8, a federal court ordered stablecoin forfeiture of approximately $212,700 linked to wages earned by North Korean IT workers. Prosecutors alleged that workers concealed their identities, obtained overseas jobs, and routed earnings through cryptocurrency.\nThe Justice Department’s June 2025 complaint alleged that unwitting employers, including blockchain companies, often paid the workers in USDC or USDT. Prosecutors described laundering through token swaps, transfers between blockchains, false-identity accounts, and smaller transactions.\nJudge Rudolph Contreras granted forfeiture for the identified wallet but denied the request covering the remaining property without prejudice because prosecutors had not adequately identified those assets in their public notice.\n\n\n\n\n\n                Read more:\n            \n\n                SEC proposes crypto custody framework for investment advisers and funds","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"}}}