AI Cut Cross-Chain Reconciliation of $387M Bitget Theft to Minutes

Artificial intelligence reduced the manual work needed to reconcile a roughly $387 million Bitget theft across four blockchain networks, compressing manual cross-chain reconciliation to under 10 minutes.

Bitget detected unauthorized transfers from hot wallets at 2:31 p.m. ET (18:31 UTC) Sept. 24. The exchange initially estimated that approximately $351.6 million was affected, later revised the figure to approximately $387.5 million and ultimately described the amount as approximately $388 million.

Approximately $387 million moved in 23 transfers during the first three hours. The funds reached Ethereum, the XRP Ledger, Zcash and Tron. Ethereum accounted for 49.7% of the transfers, followed by the XRP Ledger at 40.8%, Zcash at 7.6% and Tron at 1.8%.

The tracking process matched deposits with corresponding payouts across cross-chain liquidity and messaging protocols, instant swaps and laundering services. In one route, stolen XRP entered a cross-chain liquidity protocol while Bitcoin (BTC) emerged on another network.

More than 20 hours of manual bridge reconciliation was reduced to under 10 minutes. The system accelerated transaction matching and labeling, while investigators defined the logic, reviewed the results and directed the investigation. Labels identifying stolen funds appeared in the data platform within minutes of identification.

Tens of millions of dollars moved through one cross-chain liquidity mechanism for approximately 1.5 days. The incident illustrated the difficulty of tracking stolen crypto across networks and protocols, where assets can move between different chains and services.

The incident involved 12 hot and warm wallet addresses, while cold wallets remained secure. The exchange suspended withdrawals while it validated its systems, then resumed BTC, Ether (ETH), USDT and other withdrawals in phases between Sept. 28 and Oct. 2.

Some affected assets were frozen through coordination with exchanges, blockchain projects and security firms. No total frozen or recovered amount was disclosed. The Protection Fund held more than $464 million when the initial notice was issued, and user account balances were unaffected.

The incident was contained Sept. 25, and no further unauthorized transfers were possible. An earlier report detailed Bitget’s revised theft estimate.