Four Chains, One Attribution: Inside the $387 Million Bitget Heist

The funds moved through four blockchains. Not one. Not two. Four. Somewhere between the first hop and the last, $387 million evaporated from Bitget's hot wallets into the kind of fog that swallows liquidity faster than a dream. September 24. The date matters less than the number — and the number matters less than what happened next. Chainalysis fired up its in-house AI tracking engine and started chasing the green candle through the fog of 2017. The same fog that swallowed Mt. Gox. The same fog that swallowed FTX. The attribution came fast: North Korea. Lazarus Group. The same state-sponsored crew that's been bleeding exchanges for eight years. But here's what the press release didn't say. Attribution isn't recovery. And the gap between those two words is where your money lives or dies. Bitget is a Seychelles-registered centralized exchange. Offshore, fast-moving, heavy on derivatives. The kind of platform that thrives in bear markets because traders still need leverage even when everything's bleeding. On September 24, roughly $387 million left its hot wallets. That's not a rounding error. That's a platform-defining number. For scale, the Ronin bridge hack in 2022 was $624 million. Poly Network was $611 million. Bitget's hit sits in the same tier — the tier where user confidence either holds or collapses within 72 hours. The exchange hasn't disclosed its reserve position. That silence is louder than any statement. Chainalysis, the U.S.-based blockchain intelligence firm, was first to publish attribution. Their AI tool tracked the stolen funds across four separate blockchains. The conclusion: North Korea's Lazarus Group. This pushed the DPRK's total crypto theft for the year past $1 billion. Again. Here's what I know from watching these cases since the Bancor launch in 2017. Cross-chain tracing is the hardest problem in on-chain forensics. Attackers don't move funds in a straight line. They DEX-swap. They bridge. They mix. Tornado Cash-style tumblers break the chain of custody. The AI's job is to rebuild those connections at the breakpoints — the moments where a normal analyst loses the thread. Chainalysis says their tool does this across four chains. That's the technical claim. It's also the marketing claim. And those two things are not the same. Trace the likely path. The funds start on Bitget's native chains — probably Ethereum and Tron, given the exchange's USDT volume. From there, they split. A portion goes through a DEX like Uniswap or a bridge like Stargate. Another portion moves through a CEX deposit address that's already been flagged. The fourth chain is where things get interesting — that's usually where the mixing happens, where the trail goes cold for everyone except the AI that's been trained on eight years of Lazarus behavior. The model doesn't see a straight line. It sees a probability cloud. And it bets on the most likely next hop. Based on my experience testing AI trading bots during the 2025 NeuroChain sessions, I've learned one thing about machine-driven analysis: it overreacts to noise. The bot I tested during a live volatility event kept firing signals based on social media sentiment spikes that had zero on-chain confirmation. The developers missed it. I caught it because I was watching the tape, not the model. The same caution applies here. AI attribution models rely on pattern matching and historical address labels. They don't produce iron-clad proof. They produce probabilistic judgments dressed up as certainty. The "four blockchains" detail tells me something important: this was a sophisticated laundering operation. Lazarus doesn't move $387 million through a single chain unless they're amateurs. They're not amateurs. They've been doing this since the WannaCry ransomware attacks in 2017. The time-race framing is the tell. Racing against time means the freeze window is narrow. Hours, not days. If the funds hit a mixer before Tether or Circle or a cooperating exchange can freeze the addresses, the game is over. Attribution becomes a historical document, not an enforcement tool. This is the part nobody wants to say out loud: successful tracking does not equal successful recovery. They are completely different outcomes, and the industry constantly conflates them because the tracking firms benefit from the confusion. Fifty percent down, one hundred percent ready — that's the mindset you need when reading these headlines. Assume the worst. Then verify. Let me say the thing that the press release won't. Chainalysis is a private company. No public token. Its business model depends on crypto crime continuing to exist. More crime means more government contracts, more exchange compliance deals, more "we're indispensable" branding. This isn't a conspiracy theory. It's how the business works. The single-source nature of this attribution is a red flag. No third-party firm — not Elliptic, not TRM Labs, not Arkham — has independently confirmed the North Korea link. The methodology is a black box. The model's precision and recall rates are undisclosed. And the conclusion directly serves the company's commercial interests. That doesn't make it wrong. It makes it unverified. The real beneficiaries of this event aren't Bitget's users. They're the on-chain security analytics sector, which just got another high-profile case study to wave at regulators and enterprise clients. Watch the stablecoin issuers. If Tether or Circle freeze the addresses, the tracking becomes real. If they don't, it's just a blog post with a scary headline. Watch three signals over the next 14 days. First, OFAC's SDN list — if the Treasury adds the identified addresses, the sanctions machinery is moving. Second, Bitget's reserve disclosure — $387 million against their risk reserve determines whether users face a haircut. Third, the actual on-chain flow — if the funds enter a known mixer, recovery probability drops below 5%. Speed is the only asset that never depreciates. Right now, Lazarus is moving faster than the freeze.