Blockchain security firm BlockSec has reportedly traced the movement of funds from the Bitget exchange hack, following a reported theft of $387.5 million. According to the tracing report, sto
Blockchain security firm BlockSec has reportedly traced the movement of funds from the Bitget exchange hack, following a reported theft of $387.5 million. According to the tracing report, stolen assets moved through Bitcoin, the cross-chain liquidity protocol THORChain, and a CoinJoin mixing service, complicating recovery efforts.
KEY POINTS
The reported $387.5M theft from Bitget triggered immediate on-chain investigations from multiple blockchain security firms. BlockSec's tracing work, as described in the firm's findings, maps the outflow route taken by the attacker or attackers after the funds left Bitget.
Bitget has since identified and remediated the vulnerability behind the exchange hack, according to the platform's own disclosure. The exchange also moved to reassure users by restarting withdrawals, with BTC withdrawals reopening first and ETH scheduled for September 29.
A portion of the stolen assets was reportedly converted into Bitcoin, a common step in post-hack laundering as BTC remains the most liquid asset for cross-chain exits. After Bitcoin withdrawals reopened on Bitget, the exchange processed 4,098 BTC in user withdrawals, underscoring the scale of BTC flows tied to the incident.
BlockSec's reported trace identifies THORChain as a routing point in the fund movement. THORChain is a decentralised cross-chain liquidity protocol that enables token swaps across blockchains without a centralised intermediary, making it a frequently exploited path for moving stolen crypto across chains without a single custodian that can freeze assets.
The final destination named in BlockSec's reported trace is a CoinJoin service, a Bitcoin privacy technique that combines multiple transactions to obscure the origin of funds. A separate investigation by AMLBot traced at least 4 BTC from the Bitget hack into Wasabi CoinJoin, a well-known open-source CoinJoin implementation. The use of Wasabi aligns with the "CoinJoi" destination named in BlockSec's broader trace.
On-chain tracing can confirm fund movement paths, destination protocols, and approximate amounts, but it cannot alone attribute intent or identity to wallet addresses. BlockSec's reported trace establishes a routing sequence, from Bitget, through Bitcoin, through THORChain, and into a CoinJoin mixer, but the ultimate destination wallets and any recovery prospects remain unconfirmed based on available information.
For exchanges operating across Southeast Asia, including platforms regulated under frameworks in Singapore, Indonesia, and the Philippines, the Bitget incident highlights the operational risk posed by cross-chain laundering routes. The combination of THORChain and CoinJoin is a pattern regulators in the region have flagged in guidance around suspicious transaction monitoring. Further updates from BlockSec, Bitget, or regional regulators may refine the picture as the investigation continues.
For broader context on how the crypto bridge security landscape is evolving in response to incidents like this, Chainlink has updated its bridge technology following a $292 million hack at a rival protocol.
Additional source references: source document 1, source document 2.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on kanalcoin.com
