Within minutes of identifying funds stolen from Bitget, Chainalysis said it had placed labels on its data platform for compliance teams and law enforcement partners.
The company said $387 million was taken from the cryptocurrency exchange on 24 September, and attributed the attack to North Korean actors. Chainalysis published its report on 1 October.
The initial movement was swift. Chainalysis said $387 million left Bitget in 23 transfers during the first three hours after the exploit. Investigators traced the funds across Ethereum, XRP, Zcash and Tron.
Ethereum accounted for 49.7% of the stolen funds, according to Chainalysis. XRP accounted for 40.8%. Zcash represented 7.6%. Tron represented 1.8%.
The XRP then travelled through a cross-chain liquidity protocol and was converted into Bitcoin over roughly a day and a half, Chainalysis said. Investigators followed the XRP through cross-chain swaps to Bitcoin addresses they said were controlled by the attackers.
Chainalysis said the case involved several ways of moving funds: cross-chain liquidity protocols, messaging protocols, instant swaps and laundering services. The company said it built custom automation after the breach to connect transactions across blockchains.
Its investigators worked in a round-the-clock war room, Chainalysis said. The company said its in-house artificial intelligence cut the time needed for manual bridge reconciliation from more than 20 hours to under 10 minutes.
Bitget offered separate 5% rewards for qualifying assistance to freeze and recover stolen funds.
Comments (0)