Stolen funds from the Bitget security breach have begun moving through Wasabi’s CoinJoin mixer after a multi-stage journey across four blockchains, according to blockchain compliance firm AMLBot — the first confirmed on-chain laundering activity since the exchange confirmed roughly 387.5 million USD was transferred to attacker-controlled addresses in the September breach.
AMLBot said on September 27 that its tracing connected roughly 4 BTC in one CoinJoin round back to funds originating from a Bitget-linked TRON wallet. The firm described the activity as an apparent attempt to obscure the movement of stolen assets, and said it had blacklisted the linked addresses.
## Following the money across four chains
The route AMLBot reconstructed reads like a checklist of cross-chain DeFi plumbing. According to the firm, the attacker first converted TRX into USDT on TRON. The funds were then bridged to Ethereum through USDT0, the omnichain version of Tether designed for transfers between supported networks.
Once on Ethereum, the assets were swapped into approximately 145 ETH. That ETH then moved through THORChain, the decentralized exchange protocol, where it was converted into roughly 4.59 BTC. The Bitcoin was divided into smaller amounts before reaching a Wasabi CoinJoin round, where AMLBot’s analysis connected about 4 BTC back to the original Bitget TRON wallet.
The choice of infrastructure is telling. Every leg of the journey — a stablecoin bridge, a decentralized swap protocol, and a Bitcoin mixer — represents a category of DeFi tooling that operates without a central operator capable of unilaterally freezing funds. It is the same property that has drawn renewed scrutiny to THORChain’s decentralization model in recent days, after separate analysis highlighted how a small number of node operators can effectively pause the network while attacker funds transit it.
CoinJoin works by combining Bitcoin inputs and outputs from multiple participants in a single transaction, making it harder for blockchain observers to map one input to a specific output. Mixers weaken that protection only partially — AMLBot was still able to connect the funds through its clustering analysis, which is precisely why the firm could publish the tracing at all.
## A revised loss figure and a dormant fortune
The laundering activity comes as Bitget continues to revise its accounting of the breach. The exchange’s official investigation update raised the total value of assets transferred to attacker-controlled addresses to approximately 387.5 million USD, a figure that includes Zcash and TRON assets missing from the initial 351.6 million USD estimate.
AMLBot estimated that about 343 million USD remained dormant across thirteen attacker wallets as of September 25 — meaning the overwhelming majority of the stolen funds have not yet moved, and the 4 BTC entering a CoinJoin round represents only the first trickle of what could become a much larger laundering campaign.
Bitget has said it identified and fixed the underlying security vulnerability and plans phased withdrawals starting September 28. The exchange has also offered a 5 percent bounty for help freezing stolen funds, and its chief executive has said IP address evidence points preliminarily toward North Korean involvement, echoing the pattern of the Bybit breach — the largest crypto theft on record.
## The attribution caveat
It is worth being precise about what is known. AMLBot’s reconstruction is blockchain analysis: public records show transfers between addresses, swaps and cross-chain activity, but the purpose of each transaction is inferred from the observed flow and address attribution. The firm itself framed its finding as an apparent attempt to launder funds, not a judicial conclusion.
What the tracing does establish is capability. The compliance industry can now follow stolen assets across a stablecoin bridge, a DEX swap and into a mixer round in near real time — a fact attackers increasingly have to design around, and one that argues for patience in recovery efforts. Dormant funds are frozen funds in practice, since any significant movement generates fresh clustering data for investigators.
## Why this matters for DeFi
The Bitget laundering route lands at an awkward moment for decentralized infrastructure. The same week, analysis of THORChain’s governance model questioned how decentralized the protocol really is when node operators can coordinate pauses, and the protocol’s role in moving attacker funds — again — will intensify that debate. The European Banking Authority is simultaneously pushing new MiCA rules that could tighten access to DeFi lending in the EU.
For users, the practical lessons are limited but real. Cross-chain bridges and mixers remain the path of least resistance for laundering stolen crypto, and every major incident strengthens the case — in Brussels and Washington alike — for guardrails on exactly these tools. The irony is that the transparency that makes the tracing possible is also what regulators cite when arguing the entire stack needs oversight.
For Bitget customers, the September 28 phased withdrawal restart is the more immediate concern. For the industry, the 343 million USD still sitting in thirteen wallets is a countdown: whoever controls those keys must eventually move the funds, and when they do, analysts will be watching every hop.
*Market snapshot (Sept. 27, 12:55 UTC): BTC 84,937 USD, ETH 2,712.74 USD, SOL 123.90 USD.*
TRON to USDT0 to ETH to THORChain to a Wasabi CoinJoin. 387.5 million and they trace 4 BTC into one mixer round, the futility is the story
@chainofsobs honestly the brazen part is using USDT0, an omnichain bridge literally built for auditability. picks the most traceable rail then tries to mix
w take. USDT0 was literally built for auditability and THORChain has its own drama about halts. picking this route anyway tells you opsec was an afterthought
AMLBot blacklisting the linked addresses does nothing to the laundered portion already through THORChain. good forensics, limited teeth
TRX to USDT to USDT0 to ETH to THORChain to BTC then Wasabi. honestly impressive plumbing, every hop was permissionless so no freeze button anywhere
every hop picked for having no freeze button and then the final step is wasabi, the one mixer every analytics firm fingerprints daily. bold strategy
ironic part is the permissionless hops got him 95% of the way clean and then he hands analytics a perfect wasabi fingerprint at the last step. one hop too greedy
the fingerprint wasnt even the worst call really, wasabi coordination is public. he swapped a chain of permissionless rails for a service with an inbox
agreed, wasabi coordination is public and the coordinator logs are basically a subpoena waiting room. one bridge too many conveniences at the end
4 BTC out of 387.5M moved is basically a rounding error though. the real test is what happens when they try to move size
^ this. coinjoin rounds have tx limits, laundering 387M through wasabi would take literal years at 4 btc a pop
years at 4 btc a pop is the point. chain analytics gets better every quarter, time is on the trackers side not his
quadratic problem for the hacker tho, 4 btc a round means thousands of rounds and every single one is a fresh chance to link clusters
years assumes he even keeps custody that long. mixers get drained, operators flip, 387m through wasabi is a retirement plan with extra steps
operators flipping is the real clock here. every month he waits, wasabi coords get subpoenaed and his rounds get mapped anyway
worse, THORChain swaps print to a public orderbook. the only quiet room in the whole route was wasabi and he tipped 4 btc into it like a receipt
coordinator subpoenas are the clock nobody prices. every month of patience costs him anonymity he cant buy back
4 BTC against 387.5 million USD total is a rounding error of a test batch. expect much bigger CoinJoin volume once they spin up real laundering
^ agreed, this reads like the hacker testing detection latency with pocket change before committing real size
4 btc also happens to match wasabi per round caps almost exactly. if it was a test batch they picked the largest size that blends in
if the 4 btc sizing is deliberate thats actually smart tradecraft. blend into the per round cap instead of standing out
if its a test batch the smart move is one round then silence for weeks. repeating rounds at exactly the cap is how AMLBot pattern matched it in 48h
AMLBot traced it in what, two days? blacklisting the linked addresses does nothing to stop the next route but at least the trail is public now
AMLBot naming clusters in 48 hours while the route took weeks to build. forensics is just faster than laundering now
2,000 miles of route and AMLBot still put names on it inside 48 hours. privacy tech is fine, opsec discipline is the actual bottleneck
THORChain halting every other month and this guy still routed size through it. one halted swim and the coins sit in limbo with a full paper trail attached
a halted swim with a full paper trail attached is the nightmare scenario. he gambled the whole route on THORChain not freezing mid transfer