Bitget Hackers Move Stolen Bitcoin Through Wasabi CoinJoin

Bitget hackers have moved a small portion of the stolen Bitcoin through Wasabi CoinJoin, marking the first confirmed movement into laundering infrastructure since the attack drained hundreds of millions from the exchange. A blockchain analytics firm traced approximately 4 BTC linked to the Bitget security breach into a privacy protocol designed to obscure transaction trails.

The funds originated from a Bitget-controlled TRON wallet and were converted into USDT before being bridged to the Ethereum network through USDT0. They were then swapped for approximately 145 ETH, moved through THORChain, and converted into about 4.59 BTC. A portion of this Bitcoin entered the CoinJoin round.

AMLBot said it has blacklisted the associated wallet addresses and will continue monitoring for additional CoinJoin activity. However, most stolen funds remain dormant across 13 attacker-controlled wallets, with approximately $343.2 million - representing 88.1% of the roughly $389.4 million tracked - remaining untouched.

The use of THORChain as a bridge in the laundering chain has reignited a contentious debate about decentralized protocols and their responsibility when processing known stolen funds. Bitget CEO Gracy Chen publicly asked THORChain to refuse service to the identified addresses, warning that 'the industry is watching'.