AI Traced A $387 Million CryptoDrafting the blog article content Hack In Minutes

I keep coming back to a number that feels almost rude in its neatness. More than twenty hours of manual bridge matching, compressed into something under ten minutes. Not a lab demo. Not a slide. A live hunt after roughly $387 million left an exchange on September 24, scattered across four chains before most people had finished reading the first alert. If you have ever tried to follow a payment that hops networks, you already know why that time gap matters. The money does not wait for a spreadsheet.

What struck me was not the slogan about artificial intelligence. It was the quieter claim sitting underneath it. Investigators still set the rules, still checked the matches, still chose which lead deserved the next hour. The machine did not “solve” the case. It removed the part that usually eats a night: lining up a deposit on one chain with a payout on another, then doing it again until the pattern either holds or falls apart. Perhaps that is the only version of this story worth trusting.

What Ten Minutes Actually Bought The Investigators

Speed is easy to advertise and hard to define. In this investigation, the reported saving applied to one job inside a much larger effort: matching bridge deposits with the corresponding payouts. That sounds narrow until you have watched a trail die in the gap between two explorers. A deposit looks like an exit. A payout looks like a fresh receipt. Without a join, they read as unrelated noise.

The firm behind the tooling said investigators built custom automation for this case after the breach, drawing on more than a decade of cross-chain attribution data. Newly identified addresses picked up stolen-fund labels within minutes, and those labels became visible to compliance teams through the same data platform. Working around the clock, the team shared findings with the exchange and with law-enforcement partners. I have found that the unglamorous half of tracing is exactly this: getting a label onto an address before the next hop, not after the conference panel.

Our investigators still defined the logic, reviewed the outputs, and directed the investigation.

Investigation report on the tooling used in the case

That sentence is doing real work. It pushes back against the fantasy that a model simply “sees” crime. Logic came first. Review came second. Direction stayed with people who can be wrong in public and still have to explain the graph. If the match is sloppy, the label is sloppy, and a compliance desk freezes the wrong counterparty. Under ten minutes is only useful if the ten minutes are checkable.

Why Bridge Reconciliation Eats A Day

Think of a bridge less like a tunnel and more like a coat check with two windows that do not share a ticket stub in plain sight. You hand something in on one network. Something else comes out on another. Timing, amount, and a handful of protocol-specific quirks are often all you have. Manual work means pulling both sides, normalizing decimals, allowing for fees, and rejecting the near-misses that look clever until the third decimal place.

Twenty hours is not dramatic if a team is doing that by hand across hundreds of transfers. It is ordinary. The interesting shift is that the repetitive join moved into tooling built for this incident, while humans kept the veto. In my experience, that split is where investigations either stay honest or start decorating a theory. Automation that cannot be overruled is just a faster way to be confidently wrong.

• Investigators defined the matching rules before the machine ran them.
• Outputs were reviewed rather than published raw.
• Leads were chosen by people, not by a score alone.
• Labels reached compliance desks within minutes of identification.
• Monitoring of destination clusters continued after the first map.

The XRP Path That Paid Out In Bitcoin

One stretch of the trail is worth sitting with, because it shows why chain-by-chain viewing fails. Stolen XRP did not simply march to an exchange deposit address. Investigators described transfers through a cross-chain liquidity protocol that paid out bitcoin instead. Tens of millions of dollars moved that way over roughly a day and a half. On the XRP side, it can look like funds left. On the bitcoin side, it can look like unrelated inbound liquidity. The join is the whole story.

After those deposits and payouts were matched, later transactions were followed through several protocols toward bitcoin addresses described as attacker-controlled. The team said it would keep watching those destinations and label further addresses as funds moved. That last part matters more than the headline clock. A map from hour one is a sketch. A map that updates when the cluster splits is an investigation.

Would a purely manual team have found the same route? Probably, given enough nights. The question is whether the next hop would already have cleared a service that does not cooperate. Minutes do not recover coins by themselves. They change who gets a label while the coins are still in motion.

Four Chains, Three Hours, One Opening Burst

Within the first three hours, analysts recorded 23 transfers carrying about $387 million out of the exchange. The split was not even. Ethereum took just under half. XRP took a little over two-fifths. Zcash was a smaller slice. Tron was the remainder. That mix is awkward on purpose, or at least awkward in effect. Different explorers, different privacy properties, different compliance habits, different chances that an issuer can freeze anything at all.

The exchange later lifted its own loss estimate from $351.6 million to $387.5 million after additional Zcash and Tron transfers were included. I read that revision as a reminder, not a footnote. Early numbers in a hot-wallet incident are often the numbers you can see, not the numbers you will still be explaining next week.

How The Exchange Described The Break-In

The exchange said its systems flagged unauthorized transfers at 18:31 UTC on September 24, coming from parts of its hot and warm wallet infrastructure. Cold wallets and private keys, it said, stayed secure. The chief executive’s first account described a compromised critical backend, manipulated transaction data, and a triggered authorization process. A later account pointed to a vulnerability in a third-party security product that let attackers obtain credentials and forge withdrawal commands.

Those two descriptions are not identical, and they do not need to be smoothed into one cinematic scene. A backend that can be talked into authorizing a withdrawal, and a vendor product that leaks the keys to that conversation, can both be true in sequence. Forensic partners named in the exchange’s update included well-known incident firms. Customer balances, the exchange maintained, were not hit, because the loss sat in house infrastructure rather than in segregated user cold storage.

Still. Hot and warm wallets exist so withdrawals feel instant. That convenience is the attack surface. If you have ever refreshed a pending withdrawal and felt the minute stretch, you have touched the same design choice from the friendly side.

Attribution, Caution, And The Billion-Dollar Year

The tracing firm attributed the theft to North Korean actors and said their 2026 theft total had moved above $1 billion. The exchange chief executive was more careful at the start. She pointed to IP behavior and VPN infrastructure consistent with known North Korean operations, without confirming responsibility at that stage. Both postures can coexist. One is an intelligence assessment from a company that labels clusters for a living. The other is a public company trying not to outrun its evidence on day one.

I am wary of treating either sentence as a courtroom finding. Cluster attribution is a craft: reuse of infrastructure, timing, cash-out habits, overlaps with older labeled sets. It can be strong and still be contested. What the billion-dollar running total does make plain is scale. This was not a one-off curiosity. It landed inside a year already thick with state-linked theft allegations.

A separate United States case, reported in early September, sat in the background like a different door into the same building. A federal court ordered forfeiture of about $212,700 in stablecoins tied to wages allegedly earned by North Korean IT workers who concealed their identities, took overseas jobs, and routed pay through crypto. Prosecutors had alleged that unwitting employers, including blockchain companies, often paid in dollar-pegged tokens, with laundering through swaps, cross-chain transfers, false-identity accounts, and smaller transactions. The judge granted forfeiture for an identified wallet and denied, without prejudice, a wider request because the remaining property had not been adequately identified in the public notice.

That case is not this hack. The amounts are not in the same universe. The method, if the allegations hold, is payroll fraud rather than a hot-wallet breach. I mention it because the tracing problem rhymes. Hidden identity, a swap, a second chain, a wallet that looks ordinary until someone bothers to join the records. Speed helps there too, and so does the boring legal requirement to name the asset precisely.

The Protocol That Would Not Block Addresses

Once stolen funds began moving through a cross-chain liquidity network, the exchange asked that attacker addresses be blocked. The protocol refused selective blocking. Its position, as reported, was that emergency controls exist to protect network security, not to freeze individual wallets. Pausing the network in an incident, it argued, is not the same thing as denying service to particular addresses.

The chief executive pushed the other way. Decentralization, she argued, should not shield a service that is facilitating known stolen funds. A security firm challenged the protocol’s comparison with Bitcoin and Ethereum, noting validator-controlled vaults and a signing system that give operators powers base-layer validators do not have. That distinction is the whole argument, really. If the “validators” can collectively refuse a signature, the network is not a passive pipe. It is a committee with a kill switch it prefers not to use on customers.

A pause that saves the network is not the same decision as a blacklist that picks a wallet. Pretending those are identical is how both sides talk past each other.

I do not think there is a clean moral winner in that exchange. Selective freezes can become a political lever the moment the list is no longer obvious. Refusing every list can also become a business model for laundering, whether or not that was the intent. The practical result here was simple. Funds that had a bitcoin-shaped exit kept moving, and tracers had to follow rather than stop.

What Issuers Could Freeze, And What They Could Not

On the issuer side, earlier reporting put combined freezes by the two major dollar-token companies at roughly $318,000 in tokens linked to the breach by September 26. Set that next to $387 million and the proportion is almost embarrassing. It is also honest. Most of the haul was not in assets an issuer can claw back with an admin key. Ether, XRP, bitcoin paid out by a liquidity protocol, shielded or semi-shielded flows: the freeze button does not reach them.

People sometimes talk about stablecoin blacklists as if they were a recovery plan. They are a narrow tool for a narrow asset. Useful when the thief is sloppy enough to sit in a token with an issuer. Nearly decorative when the route is designed to leave that token behind. The small freeze number is not evidence that issuers shrugged. It is evidence of asset choice.

Two Five-Percent Rewards, And The Fine Print

The exchange published recovery terms with two separate incentives. Qualifying help that results in funds being frozen can earn a 5% bounty. Successful recovery carries a separate 5% reward. Read that twice. Freeze and recovery are not the same event. A labeled address that an issuer or a cooperative service locks is not the same as coins returned to the victim’s treasury.

Bounties pull in independent tracers, and sometimes they pull in noise. A public percentage gives researchers a reason to send a graph instead of a screenshot. It also invites duplicate claims, vague “I saw a wallet” tips, and arguments over who matched the bridge first. If I were writing the internal memo, I would want a single intake desk, a timestamped evidence format, and a rule for splitting credit when two teams label the same hop an hour apart.

1. Assistance that leads to a qualifying freeze can earn 5%.
2. A completed recovery can earn a separate 5%.
3. The two rewards do not automatically stack into a story of coins already home.
4. Public terms still need a private process for judging who actually helped.

Withdrawals Came Back On A Staggered Clock

By a September 30 update, the exchange said major asset withdrawals were returning. Bitcoin on September 28. Ether on September 29. The main dollar stablecoin on September 30. Remaining token, fiat, and peer-to-peer withdrawals were scheduled for October 2 at 08:00 UTC. That stagger is what a treasury looks like when it is refilling hot wallets without reopening the same hole. Users experience it as a queue. Operators experience it as a risk budget.

The chief executive also said the protection fund had moved back above $300 million. A September 29 reserve snapshot reported a 131% overall ratio across 19 covered assets, each above 100%. The exchange’s line remained that customer balances were unaffected. Snapshots are not audits, and a ratio on a Tuesday is not a promise about Thursday, but the figure was the public answer to the obvious fear: that a house loss would be quietly socialized across user accounts.

Public recovery markers, as described:
  Loss estimate revised upward to about $387.5 million
  Protection fund reported back above $300 million
  Reserve snapshot: 131% overall, 19 assets, each above 100%
  Major withdrawals restored in stages from September 28
  Remaining rails scheduled for October 2, 08:00 UTC

What The Graphs Were Actually Showing

Beyond the opening withdrawals, analysts pointed to cross-chain liquidity and messaging protocols, instant-swap services, and links into laundering services. Published transaction graphs, according to the report, showed portions of the hundreds of transfers made after the breach. Hundreds is the number that should slow you down. Twenty-three opening transfers are a headline. Hundreds of follow-on moves are the job.

Laundering services in this context are not a single villainous website. They are clusters: swap routers, over-the-counter desks with thin questions, bridges that do not tag provenance, and sometimes plain peer transfers meant to look like payroll. A graph that colors those hops is an argument. It still needs a human who will say which color is evidence and which color is a hypothesis.

That is where the under-ten-minute claim either earns its keep or becomes marketing. If the automation only redrew the first 23 transfers, it saved a coffee. If it kept joining bridge legs across those hundreds of later moves, while investigators threw out the false joins, then the clock is a real operational fact. The report frames it as the latter. I would still want the false-positive rate, which almost no public write-up includes.

A Human Pace Versus A Machine Pace

There is a temptation to turn this into a morality play about analysts versus models. I do not buy it. The dull middle of tracing has always been eligible for scripts. What changed is that the script can be stood up for a specific case, against a specific protocol’s quirks, without a six-month product cycle. Investigators described the AI as help in building those tools, not as a replacement for the person who decides a lead is worth a phone call to a partner agency.

Consider the failure modes, because they are the interesting part.

• A timing window that is too wide will marry unrelated transfers of similar size.
• A window that is too tight will miss a payout delayed by a queue or a manual review.
• Fee assumptions that ignore a protocol’s affiliate cut will reject true matches.
• Privacy pools can make amount matching meaningless even when the route is real.
• A label pushed too early can poison a compliance feed that other firms trust.

None of those are solved by saying “AI.” They are solved by someone who has been burned by a bad join before and is willing to throw a pretty graph away. The report’s insistence on human direction is, to me, the credible sentence. The stopwatch is the sentence that travels.

What Users Can Actually Take From A Case Like This

Most readers are not going to reconcile a bridge. They are going to decide where coins sleep. A few plain lessons keep showing up in incidents of this shape, and they do not require a forensic background.

Leave trading balances on an exchange if you are trading. Move the rest. Hot wallets are a service, not a vault, even when the marketing says otherwise. A protection fund and a reserve ratio are shock absorbers. They are not the same thing as your keys. If an exchange pauses withdrawals, the pause is information. It can mean prudence. It can mean the hot wallet is empty. Reading the asset-by-asset restart schedule tells you more than a single “we are safe” post.

On the tracing side, public labels help only if your own withdrawal habits are not already mixed into a messy cluster. That is a smaller point, but I have seen people panic because a compliance alert touched an address two hops from something they did months ago. Distance on a graph is not guilt. It is a prompt to look.

The Decentralization Argument, Without The Slogans

The refusal to block addresses will be quoted for months, on both sides. One side will say a neutral protocol cannot become a deputy sheriff. The other will say a protocol with a signing committee is already a business, and businesses turn away known stolen goods every day. Both lines are tidy. The messier version is that emergency powers already exist, and the fight is over who may invoke them.

If operators can halt the network to save it from a bug, they have a collective hand on the pipe. Choosing not to use that hand against a labeled theft is a policy, not a law of physics. Choosing to use it sets a precedent the next requester will cite, and the next requester may be less obviously in the right. I do not have a universal rule that survives both cases. I do think comparisons to base-layer chains are weak when the architecture includes vaults those chains do not have.

For tracers, the policy outcome is operational. You plan for non-cooperation. You match faster. You label what you can. You hand the cooperative venues a list while the uncooperative venue keeps routing. The ten-minute bridge join is partly a technical story and partly an adaptation to venues that will not stop the music.

Where The Money May Still Be Sitting

Public reporting did not claim the $387 million was back. It claimed a path: opening withdrawals, a liquidity route from XRP into bitcoin, further hops, attacker-controlled bitcoin addresses under watch, and a plan to label more as movement continued. That is an unfinished sentence. Clusters split. Some fraction hits a service that will freeze. Some fraction sits. Some fraction moves into venues that treat provenance as someone else’s problem.

The bounty structure implies the exchange still believes outside help can change that mix. So does the continued monitoring language. Investigations like this rarely end with a single dramatic seizure. They end, when they end well, as a series of smaller interruptions: a frozen stablecoin dusting, a seized off-ramp account, a labeled cluster that market makers start to avoid. Glamorous, no. Cumulative, sometimes.

A practical read of the case clock:
  detect unauthorized flow
  + join bridge legs fast
  + label destinations
  + notify cooperative venues
  + keep watching splits
  = a narrower escape window, not a guaranteed return

Vendor Risk Hiding Inside “We Were Hacked”

The later finding, a flaw in a third-party security product that yielded credentials and forged withdrawal commands, should annoy anyone who has filled out a vendor questionnaire and felt safer afterward. Security products sit on the path to authorization. If that path can be counterfeited, the cold-wallet sermon is beside the point for the coins that were hot. The keys to the vault can be fine while the intercom that orders the vault open is not.

I would want, in a post-incident review, a painfully specific answer. Which product. Which permission. Which log should have screamed. Which human step was supposed to be out-of-band and was not. Public posts rarely go there, and vendors rarely volunteer. Users are left with the outline: backend manipulation, then a vendor credential path, cold storage described as intact. Enough to update your own threat model. Not enough to audit theirs.

Why The First Revision Of The Loss Figure Matters

Moving from $351.6 million to $387.5 million because Zcash and Tron transfers were added later is a small masterclass in incomplete visibility. Privacy-preserving transfers and secondary networks are exactly the flows a first-pass dashboard undercounts. Anyone quoting the early figure as the final one was guessing. Anyone treating the revised figure as sacred should stay humble too. Further hops can reveal fees, partial returns, or amounts that were double-counted across a bridge.

Good tracing culture publishes the revision. Bad tracing culture locks the first tweet and argues with the update. The upward revision here is a mark in favor of the first kind, at least on the accounting.

Compliance Desks And The Minute-Old Label

A label that lands in a compliance platform within minutes changes a different clock, the one inside exchanges that were not hacked. A deposit screening system can only block what it knows. If the stolen cluster is unnamed, the deposit looks clean. If the cluster is named before the cash-out attempt, the deposit becomes a case. That is the commercial reason firms buy attribution data, and it is also the civil-liberties reason to demand review. A false label is not a rounding error when it freezes a payroll.

The investigation write-up stresses review before direction. Hold them to it. Minute-scale labeling is a feature only if the appeal path is faster than the next block, or at least faster than a support ticket that dies over a weekend. I have less patience for “the model said so” than the industry’s sales pages do.

A Note On The Wider Enforcement Picture

The wage-forfeiture matter from early September is easy to skip because the dollar figure looks small beside a nine-figure exchange breach. Do not skip the method. Alleged workers hid nationality, took remote jobs, and pushed earnings through token swaps and chain hops. A judge was willing to forfeit what prosecutors had identified cleanly, and unwilling to sign away assets the public notice had not pinned down. Identification is the product. AI-assisted joins are one way to produce it. They are not a substitute for naming the thing you want seized.

Put the two stories side by side and a pattern shows up without needing a conspiracy board. State-linked actors, if the attributions hold, use both smash-and-grab infrastructure attacks and quieter income routes. Defenders who only staff for the spectacular breach will miss the payroll. Defenders who only staff for sanctions screening will miss the hot wallet. The tracing toolchain has to serve both, which is another reason generic models are less interesting than case-built matchers.

What I Would Watch In The Next Two Weeks

Not price. Movement. Whether newly labeled bitcoin addresses stay still, split into dozens of mid-sized outputs, or touch a service that has frozen this cluster before. Whether the liquidity protocol’s public stance softens once more of the route is documented, or hardens into a template other venues copy. Whether the bounty produces a documented freeze that is more than dust. Whether the reserve ratio is published again after withdrawals fully reopen, or only when the questions are loud.

I would also watch the language. If later updates still say investigators directed the logic, the tooling story stays adult. If later updates slide into “AI recovered the funds,” someone is selling you a clock without a graph. There is a difference, and it is the difference that decides whether this write-up ages into a case study or a brochure.

A Fair Reading, Stripped Of The Applause

Here is the version I can stand behind. An exchange lost on the order of $387 million from hot and warm infrastructure after a backend and vendor-credential failure, while describing cold keys as untouched. Opening transfers hit four networks inside three hours. A large XRP slice was swapped, via a liquidity protocol, into bitcoin rather than deposited as XRP. Matching those legs by hand was a day-scale chore. Case-specific automation cut that chore to minutes, with humans still owning the rules and the review. A major routing protocol declined to blacklist addresses. Issuer freezes caught a thin stablecoin slice. Withdrawals returned in stages. A protection fund and a reserve snapshot were offered as evidence that users were not the purse. Attribution to North Korean actors is the tracing firm’s assessment. The exchange’s first public line was consistent indicators, not a confirmed name.

That is a lot. It is also not a recovery announcement. Anyone telling you the money is home is ahead of the public record. Anyone telling you tracing is pointless because one protocol said no is ignoring the labels, the freezes that did happen, and the bounty still on the table.

The part I keep turning over is small and human. Somebody still had to decide the match was real. Somebody still had to say this address, not that one. The machine made that person faster. It did not make them optional. In a year when theft figures are already being quoted in the billions, that may be the only comfort on offer, and it is thinner than the headlines want. It is also, for once, specific enough to test.