About 4 Bitcoin Linked to Bitget Hack Moved to CoinJoin Service
Summary
- Authorities said about 4 BTC linked to the Bitget hack appears to have flowed into a CoinJoin service, which makes transaction tracking more difficult.
- AMLBot said funds tied to a Bitget Tron wallet were converted through USDT, ETH and THORChain into about 4.59 BTC before being split and transferred.
- AMLBot said it has blacklisted the related wallet addresses and is tracking any further use of CoinJoin, though the full scale of the losses and the final movement of the stolen funds have not been confirmed.
Forecast Trend Report by Period
About 4 Bitcoin linked to the Bitget hack appears to have been funneled into a CoinJoin service that makes transactions harder to trace.
Wu Blockchain reported on September 27 that blockchain analytics firm AMLBot had confirmed that some funds believed to have been stolen from Bitget were moved to Wasabi Wallet's CoinJoin service.
AMLBot traced the path of about 4 BTC that entered a specific CoinJoin transaction and found the funds were linked to a Tron wallet associated with Bitget. The funds moved along a complex route across multiple blockchains and digital assets.
The funds were converted from Tron (TRX) into Tether (USDT) and then moved to the Ethereum network through USDT0. They were later exchanged into about 145 Ether and then converted into about 4.59 BTC through cross-chain liquidity protocol THORChain.
The Bitcoin was then split across multiple addresses before being sent to the CoinJoin service. CoinJoin combines Bitcoin transactions from multiple users into a single transaction, making it harder to trace the path of individual funds.
AMLBot has blacklisted the related wallet addresses and is continuing to track whether the attacker uses CoinJoin again for Bitcoin still in its possession.
The roughly 4 BTC identified in this case represents only the amount traced in one specific CoinJoin transaction. It does not establish the total scale of losses from the Bitget hack or the final destination of the stolen funds.
Suehyeon Lee
shlee@bloomingbit.ioI'm reporter Suehyeon Lee, your Web3 Moderator.