The 3-Hour, 4-Chain Dissipation: Tracing the Path of $387M

A new report from blockchain analytics firm Chainalysis, dated October 2nd, sheds light on the complex movement of funds following a major security breach at crypto exchange Bitget on September 24th. The staggering $387 million in stolen assets was dispersed across multiple blockchains in a rapid, coordinated operation lasting just three hours, involving 23 separate transactions.

Precise Allocation and Obfuscation Tactics

The stolen capital was not consolidated but strategically split across four distinct blockchain networks:

  • Ethereum: Received approximately 49.7% of the funds, serving as the primary landing zone.
  • XRP Ledger: Was used for about 40.8% of the funds. Notably, the attackers avoided sending XRP directly to exchanges.
  • Zcash (ZEC): Accounted for roughly 7.6% of the funds, leveraging its enhanced privacy features.
  • Tron: Held the remaining 1.8%.

This multi-chain strategy significantly complicates efforts to trace and freeze the assets.

The Cross-Chain Cash-Out and Current Status

A key finding involves the handling of the XRP portion. Demonstrating operational caution, the attackers bypassed direct exchange deposits. Instead, they utilized a decentralized cross-chain liquidity protocol to swap the XRP for Bitcoin (BTC). This conversion and subsequent movement of tens of millions of dollars took place over approximately 36 hours.

Currently, these converted Bitcoin funds remain held at addresses controlled by the attackers. Chainalysis has confirmed that these addresses are flagged and under active monitoring, leaving a potential avenue for future legal action.

AI-Powered Tracking: Compressing 20+ Hours of Work into Minutes

The report also highlights advances in blockchain forensic technology. Chainalysis noted that its AI-powered tools dramatically accelerated the investigation. Tracing interconnected transactions across multiple blockchains, a task that could traditionally take over 20 hours of manual correlation, was completed by its system in about 10 minutes. This represents a significant leap in response capability for large-scale security incidents.

The Broader Threat: North Korean Hackers Surpass $1B in Annual Crypto Theft

Chainalysis contextualized this incident within a larger threat landscape. The report states that hackers affiliated with North Korea have stolen over $1 billion worth of cryptocurrency in 2026 (Note: The original text cited 2026; this may be an error for 2023/2024. The original figure is retained). This staggering figure underscores the persistent and systemic risk posed by state-sponsored actors to the crypto ecosystem. Their sophisticated techniques and complex fund-moving strategies remain a top priority for global regulators and security firms.