What happened in the Bitget hack?
Bitget, one of the larger centralised crypto exchanges by volume, suffered a major security breach resulting in the loss of approximately $387.5 million in user funds. The exchange later identified and remediated the underlying vulnerability that made the theft possible. For context on the operational fallout, Bitget published a timeline for restarting Bitcoin and Ethereum withdrawals as it worked to contain the damage.
BlockSec, a blockchain security and on-chain analytics firm, mapped how the attacker moved funds across multiple chains and protocols in an attempt to obscure the trail.
How the stolen funds moved through Bitcoin and THORChain
The attacker did not simply hold the stolen assets. The funds were routed through THORChain, a decentralised cross-chain liquidity protocol that allows users to swap assets across blockchains without a centralised intermediary. THORChain’s permissionless design makes it a recurring vehicle for post-hack fund movement.
BlockSec’s trace showed the hacker used THORChain to convert stolen holdings into Bitcoin. That move was confirmed separately when the attacker swapped Ethereum for Bitcoin through THORChain after the protocol declined a freeze request, a decision that drew significant attention at the time.
Bitget resumed Bitcoin withdrawals after that swap was confirmed, suggesting the exchange had enough confidence in the tracing to distinguish hacker-linked funds from user assets.
The CoinJoin connection and what the tracing shows
Once in Bitcoin, a portion of the funds moved into CoinJoin, a privacy technique that pools multiple transactions together to obscure which inputs correspond to which outputs. It is not a single service but a method, most commonly associated with tools like Wasabi Wallet.
Separate on-chain analysis by AMLBot found that at least 4 BTC from the Bitget hack was traced to Wasabi’s CoinJoin implementation, providing a specific, verified data point within the broader BlockSec trace.
The full path BlockSec reported, theft to THORChain swap to Bitcoin to CoinJoin mixing, follows a pattern seen in other major exchange hacks: convert to a liquid asset, cross chains to break tracking continuity, then obscure the Bitcoin trail with mixing. Whether the complete $387.5 million has been fully accounted for, or whether significant portions remain untraced, is not confirmed by the available evidence.
What BlockSec’s work makes clear is that “stolen” does not mean “gone without a trace.” The question now is whether any of it can be recovered, or whether the mixing layers have made that effectively impossible.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
