Blockchain security firm BlockSec traced funds from a reported $387.5 million theft linked to Bitget through Bitcoin, the THORChain cross-chain protocol, and CoinJoin mixing services, mapping
Blockchain security firm BlockSec traced funds from a reported $387.5 million theft linked to Bitget through Bitcoin, the THORChain cross-chain protocol, and CoinJoin mixing services, mapping an obfuscation route that spans multiple networks and privacy tools.
The reported theft, totaling approximately $387.5 million, became one of the largest exchange-linked exploits tracked this year. BlockSec's on-chain analysis identified that stolen assets were converted and routed through Bitcoin before passing through additional layers designed to complicate recovery efforts. For related coverage, see Bitget Wallet and Polymarket Launch World Cup Prediction Markets.
THORChain, a decentralized cross-chain liquidity protocol, appeared in the traced path as a bridge between asset types. THORChain subsequently declined to block the wallet addresses associated with the $387.5 million in Bitcoin moves, citing its permissionless design, which left the cross-chain channel open to further movement.
CoinJoin, the Bitcoin privacy technique that merges multiple transactions to obscure their origins, was identified as a final obfuscation layer in the traced route. Separately, AMLBot traced 4 BTC from the Bitget hack to Wasabi CoinJoin, a non-custodial Bitcoin wallet that implements CoinJoin mixing natively, corroborating the broader pattern BlockSec identified.
The three-stage route reflects a recognized playbook for laundering stolen crypto: convert to Bitcoin for liquidity depth, use a cross-chain bridge to sever the asset trail, then apply a mixing service to fragment transaction history on-chain. Each layer adds forensic complexity without requiring any single custodian's cooperation.
THORChain's refusal to intervene highlights a structural tension in decentralized finance: permissionless infrastructure cannot distinguish between legitimate cross-chain swaps and post-exploit laundering without centralized controls that conflict with its design principles. Investigators can observe the movement on-chain but cannot reverse or freeze it.
On-chain tracing firms like BlockSec and AMLBot can follow funds across these layers by clustering wallet addresses and mapping swap events, but confirmed attribution of wallets to specific individuals requires off-chain intelligence that blockchain data alone cannot provide.
Despite the scale of the reported exploit, Bitget moved to restore user access. Bitget resumed BTC withdrawals following the $388 million exploit, and the exchange subsequently published a phased timeline for restoring further access, with BTC withdrawals reopened and ETH withdrawals scheduled for September 29.
The fund movements BlockSec traced were already in progress before Bitget completed its withdrawal restoration, meaning the obfuscation route was established rapidly in the hours and days following the initial breach, a pattern consistent with other large-scale exchange exploits where attackers prioritize speed of obfuscation over transaction efficiency.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on nftenex.com
