Zcash

THORChain

<h2 id="b-tldr-b">TLDR:</h2>
<ul>
 <li style="font-weight: 400">AMLBot traced about 4 BTC into a Wasabi CoinJoin after the funds moved through TRON, Ethereum and THORChain.</li>
 <li style="font-weight: 400">About $343.2M, or 88.1% of roughly $389.4M tracked by AMLBot, remained dormant across 13 attacker wallets.</li>
 <li style="font-weight: 400">Bitget raised its confirmed loss estimate to $387.5M after adding previously uncounted Zcash and TRON assets.</li>
 <li style="font-weight: 400">Bitget will resume withdrawals on September 28 with Bitcoin, with broader restoration through October 2.</li>
</ul>
Funds linked to the Bitget security breach have started entering <a href="https://blockonomi.com/bitcoin-privacy-breakthrough-new-proposal-mimics-zcash-without-network-changes/" rel="noopener noreferrer nofollow">Bitcoin privacy</a> infrastructure, adding a new layer to investigators’ efforts to follow stolen assets. AMLBot reported on September 27 that roughly 4 BTC entered a Wasabi CoinJoin after moving through several assets, blockchains, and cross-chain services.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 Update: It seems stolen funds from the <a href="https://x.com/bitget?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@bitget</a> hack have started to be laundered through Wasabi CoinJoin (mixer)
 Our tracing links ~4 BTC in a CoinJoin round back to a Bitget TRON wallet. The funds were swapped from TRX to USDT, bridged to Ethereum via <a href="https://x.com/USDT0_to?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@USDT0_to</a>, swapped to ~145… <a href="https://t.co/8JBaoMM1xp" rel="noopener noreferrer nofollow">https://t.co/8JBaoMM1xp</a><a href="https://t.co/ncTVyeIT3S" rel="noopener noreferrer nofollow">pic.twitter.com/ncTVyeIT3S</a>
 — AMLBot (@AMLBotHQ) <a href="https://x.com/AMLBotHQ/status/2103895436557992242?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 26, 2026</a>
 </blockquote>
</div>
The movement covers only a small fraction of the theft. Meanwhile, about $343.2 million of tracked assets remained dormant across attacker-controlled wallets.
<h2 id="b-attacker-routes-funds-from-tron-to-bitcoin-b">Attacker Routes Funds From TRON to Bitcoin</h2>
According to AMLBot, the transaction path began with a Bitget-linked <a href="https://blockonomi.com/tether-freezes-usdt-in-131-tron-wallets-as-u-s-sanctions-target-isis-k-crypto-network/" rel="noopener noreferrer nofollow">TRON wallet</a> before the attacker converted TRX into USDT. The USDT was then bridged to Ethereum through USDT0, where the funds were exchanged for approximately 145 ETH.
Those assets later moved through THORChain and produced about 4.59 BTC, extending the trail from TRON to Ethereum and then Bitcoin. The attacker subsequently divided the BTC into smaller amounts before roughly 4 BTC entered a Wasabi CoinJoin round.
Wu Blockchain separately <a href="https://x.com/WuBlockchain/status/2104007768520921574?s=20" rel="noopener noreferrer nofollow">reported</a> the same transaction path, while CertiK’s security feed also recorded AMLBot’s finding. Wasabi describes CoinJoin as a Bitcoin transaction that combines inputs from several participants and creates multiple new outputs.
That structure weakens the visible connection between individual inputs and outputs, making the origin-to-destination relationship harder to establish directly from blockchain records. However, CoinJoin participation does not indicate wrongdoing by other users as the privacy method is designed for general <a href="https://moneycheck.com/senator-lummis-unveils-crypto-tax-bill-to-simplify-bitcoin-transactions/" rel="noopener noreferrer nofollow">Bitcoin transactions</a>.
For investigators, attribution matters as CoinJoin reduces the clarity of subsequent transaction paths. AMLBot said it blacklisted associated addresses and would keep monitoring the funds for additional CoinJoin activity.
<h2 id="b-343m-in-bitget-hack-funds-remains-dormant-across-13-wallets-b">$343M in Bitget Hack Funds Remains Dormant Across 13 Wallets</h2>
Despite the latest movement, most funds linked to the <a href="https://coincentral.com/bitget-hack-total-jumps-to-388-million-as-new-details-emerge/" rel="noopener noreferrer nofollow">Bitget breach</a> remained dormant in AMLBot’s September 25 assessment. The firm estimated that about $343.2 million, representing 88.1% of roughly $389.4 million tracked, had not moved across 13 attacker wallets.
Those wallets held about 68,300 ETH across eight addresses, nearly 83 million XRP across four wallets, and around 18,900 ZEC elsewhere. That concentration leaves the latest privacy movement small compared with assets remaining stationary across the attacker wallets.
<a href="https://www.bitget.com/support/articles/12560603896108" rel="noopener noreferrer nofollow">Bitget’s accounting</a> was slightly lower, with the exchange confirming approximately $387.5 million transferred to attacker-controlled addresses. That figure revised an earlier $351.6 million estimate after additional Zcash and TRON assets were included in the total.
Bitget said the underlying vulnerability had been identified and remediated, while Mandiant and SlowMist continued assisting with the investigation. Withdrawals are <a href="https://www.bitget.com/support/articles/12560603896110" rel="noopener noreferrer nofollow">scheduled</a> to resume gradually from September 28, starting with Bitcoin, before broader restoration continues through October 2.
The CoinJoin activity therefore represents the clearest confirmed movement into <a href="https://parameter.io/top-privacy-focused-cryptocurrencies-for-long-term-investment-monero-xmr-zcash-zec-and-bittensor-tao/" rel="noopener noreferrer nofollow">privacy-focused infrastructure</a> so far, while most tracked stolen assets remain unmoved.
The post <a href="https://blockonomi.com/bitget-hacker-moves-4-btc-into-wasabi-coinjoin-as-343m-stays-dormant/" rel="noopener noreferrer nofollow">Bitget Hacker Moves 4 BTC Into Wasabi CoinJoin as $343M Stays Dormant</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Bitget Hacker Moves 4 BTC Into Wasabi CoinJoin as $343M Stays Dormant

Table of Contents

Blockonomi

Other articles published on Sep 27, 2026

Join our free newsletter for daily crypto updates!