Chainalysis said it traced approximately $387 million to $387.5 million stolen from Bitget on September 24, 2026, as attacker-linked wallets continued moving and converting assets across blockchains. Within three hours, the funds moved through Ethereum, XRP, Zcash and Tron before passing through cross-chain liquidity and messaging protocols, instant swaps, mixers and laundering services. Chainalysis used in-house AI to build custom automations, compressing more than 20 hours of bridge reconciliation to under 10 minutes while investigators retained responsibility for logic, review and direction. On October 1, MistTrack reported that an attacker-linked address was swapping DAI on Ethereum and bridging proceeds to Tron. Issuers and protocols froze or rejected only a small portion of the funds, while THORChain declined selective blocking because of its permissionless design. Bitget said customer balances were not reduced, restored its User Protection Fund to $309 million including 3,705 BTC, and scheduled remaining withdrawals, fiat and peer-to-peer services to reopen at 08:00 UTC on October 2.