The Bitget Breach: How $387.5M Moved Through THORChain and Wasabi CoinJoin, and Why Freezes Recovered Under 1%

The reported September 24, 2026 Bitget breach is a useful forensic case study because it separates three questions that are often bundled together:

1. How were the assets removed?

2. How did the funds move after the theft?

3. What can investigators actually prove from the ledger?

According to Bitget, approximately $387.5 million was drained from hot and warm wallets. Bitget initially reported approximately $351.6 million, then revised the figure after adding Zcash and TRON transfers. Bitget stated that its private keys were not compromised, cold wallets were unaffected, and user balances would be covered by its protection program.

The difference is not whether the blockchain tells a story. It does. The difference is whether the story is properly attributed, preserved, and separated from assumptions.

1. What reportedly happened inside Bitget

Bitget, SlowMist, and Mandiant reported that the entry vector involved a zero-day vulnerability in a third-party security product. The reported sequence involved high-privilege credential access, movement to the production wallet job server, and forged withdrawal commands that bypassed ordinary risk controls.

SlowMist reportedly traced the earliest malicious activity to August 31, 2026. The large-scale withdrawal activity occurred on September 24.

At approximately 18:31 UTC, two low-value test transfers were reportedly made: 0.84 ETH and 93 TRX.

According to Bitget's account, both transfers were below risk-control thresholds and generated no alert. Large outflows began at approximately 18:58 UTC. Bitget reported 26 successful outflows, with the last occurring at 21:23 UTC. Signing machines were shut down at approximately 21:44 UTC.

This sequence matters because the incident was not simply a private-key theft. The reported mechanism was an abuse of internal wallet infrastructure and command authorization. That distinction affects the preservation targets:

Third-party security appliances

Privileged credentials and access logs

Wallet job-server activity

Withdrawal-command records

Risk-control logs

Signing-machine telemetry

Internal database and environment-variable artifacts

Production deployment records

A transaction hash proves that an asset moved. It does not, by itself, prove which internal command generated the transaction or which person controlled the relevant credentials.

2. Why on-chain forensics still produced a detailed map

The public ledger cannot expose Bitget's internal systems. It can, however, document the downstream consequences with considerable precision.

Investigators can identify:

Originating wallet addresses

Block heights and confirmation times

Token contracts and asset quantities

Smart-contract calls

Swap routers and bridge contracts

Cross-chain service touchpoints

Bitcoin UTXO relationships

Timing gaps between deposits, swaps, refunds, and withdrawals

Repeated transaction patterns and address clusters

That is the foundation of cryptocurrency tracing. It is also why the phrase "crypto is anonymous" is too blunt to be useful. The more accurate statement is that blockchain records are pseudonymous, while identity and control usually require additional evidence.

On-chain records versus off-chain records

On-chain records include transaction hashes, wallet addresses, token transfers, smart-contract calls, block timestamps, bridge events, UTXO structures, and observable service interactions.

Off-chain records include exchange account data, KYC files, IP logs, device images, internal access records, communications, bank statements, vendor logs, and legal process responses.

On-chain analysis can establish that value moved between identified addresses or interacted with a particular protocol. It generally cannot establish the human owner of an unhosted wallet without corroborating off-chain evidence.

blockchain investigation therefore treats the ledger as a primary record, not a complete identity database.

3. The three-stage laundering path

Stage one: convert issuer-controlled assets

According to BlockSec's review of the Bitget tracing dashboard, approximately $75.48 million in USDT, USDC, and USDT0, plus approximately 3,000 XAUt, were converted into native assets within 41 minutes.

Reported swap touchpoints included UniswapX, Uniswap, 1inch, and MetaMask's swap feature.

The assets were converted primarily into ETH or AVAX. That behavior has a clear investigative logic: issuer-controlled stablecoins may be subject to address freezes, while native assets cannot ordinarily be frozen by a centralized token issuer.

The key question is not merely, "Where did the stablecoins go?" It is: What asset entered the next service, through which contract, at what time, and under whose apparent control?

Stage two: consolidate across chains into Bitcoin

The next phase involved cross-chain routing and consolidation. BlockSec reported that approximately 90% of the value moving toward Bitcoin originated on Ethereum.

Reported pass-through figures included:

THORChain — approximately $269 million across 7,804 transactions

USDT0/LayerZero — approximately $55.13 million

Circle CCTP — approximately $49.33 million

Chainflip — approximately $37.27 million

Across — approximately $14.38 million

Stargate — approximately $12.82 million

These figures must not be added together. They represent pass-through value, not separate pools of stolen assets. The same value may touch multiple services during a chain-hopping sequence.

THORChain became the most visible service touchpoint. CoinDesk reported that 27 successful THORChain swaps moved approximately 2,390 ETH into 75.2 BTC, with the Bitcoin payouts directed to one address. Four additional swaps involving approximately 400 ETH were reportedly pending at the time of review.

For a forensic report, each route should be documented as a linked event:

1. Source transaction hash

2. Deposit asset and quantity

3. Protocol or router interaction

4. Cross-chain settlement record

5. Destination-chain transaction hash

6. Receiving address

7. Subsequent movement or consolidation

That is how an investigator can trace a Bitcoin transaction without pretending that every cross-chain conversion is a simple wallet-to-wallet transfer.

Stage three: Bitcoin CoinJoin

By September 29, BlockSec reported that approximately $3.94 million had entered CoinJoin transactions. One transaction confirmed at 11:03 UTC on September 27 reportedly contained 356 inputs, 401 outputs, four inputs of 2.5 BTC each from attacker-labeled addresses, and 21 outputs of 0.02097152 BTC each.

CoinJoin does not erase the transaction. It changes the evidentiary problem.

Bitcoin's UTXO model makes inputs and outputs visible, but a CoinJoin transaction intentionally creates uncertainty about which participant owns which output. On-chain data alone cannot reliably assign each equal-denomination output to a particular input owner.

That is not the same as saying the funds are untraceable. It means the report must distinguish:

Directly observed input participation

Probabilistic output analysis

Timing and denomination evidence

Later spending behavior

External attribution evidence

A strong report stops at the commingling boundary when necessary. It does not convert a plausible association into a statement of ownership.

4. Why the freeze math favored timing

Approximately five days into the incident, BlockSec reported that about $342 million, or 88.3% of the stolen total, remained under attacker control. The reported composition was approximately 83.7% BTC (about 3,386 BTC), 8.5% ZEC, and 7.3% ETH.

Publicly visible freezes were far smaller. BlockSec reported approximately $840,000 frozen by September 29, or about 0.2% of the reported theft. Press reports later placed the total at approximately $1.07 million to $1.1 million by early October, or about 0.28%.

Tether and Circle reportedly froze approximately $320,000 to $340,000 in stablecoins left idle at attacker-linked addresses. NEAR Intents said its SHIELD risk layer froze approximately $503,000 during execution after flagging more than $50 million in attempted activity. NEAR also reported that approximately $166,000 completed.

The freeze results were governed less by detection alone than by dwell time.

BlockSec reported that PancakeSwap's cross-chain service had a median arrival time of 88 seconds. Four stablecoin transfers were delayed between 62 and 83 minutes, arriving between 23:36 and 23:47 UTC after the attacker had stopped operating the relevant address at 23:07.

A separate 21,090 USDT THORChain refund reportedly took 109 minutes to arrive. That delay created a practical preservation window.

By contrast, approximately 425,959 USDT that arrived at 07:01 on September 29 reportedly moved again after one hour and 14 minutes and was not frozen.

The lesson is operational rather than dramatic: automated controls cannot freeze assets that never remain at a controllable touchpoint long enough to be identified and restricted.

THORChain declined to selectively freeze the reported addresses, stating that the protocol "doesn't censor by design." Bitget's CEO argued publicly that decentralization should not shield the facilitation of known stolen funds. The disagreement is significant, but it does not change the evidentiary record: the service processed visible transactions, and those transactions remain available for analysis.

5. Attribution: useful lead, not courtroom shortcut

Multiple parties suggested that the breach was connected to DPRK-linked TraderTraitor activity. That attribution remains unconfirmed in the available public record.

The supporting points reportedly include:

Similar laundering routes

A claimed connection to the July 2026 AFX hack through one wallet holding approximately $4,300

Chain-hopping through bridges

Wasabi deposits

A peel-chain pattern identified by Arkham

ZachXBT's identification of five Chinese illicit actors allegedly laundering funds for the attackers

ZachXBT also reportedly linked one of those actors to the approximately $292 million Kelp DAO exploit.

These observations may support investigative hypotheses. They do not establish that the Bitget attackers and the actors connected to earlier incidents were the same people.

The 2025 Bybit incident illustrates the problem. Approximately $1.5 billion was stolen from a Bybit cold wallet, and the FBI later attributed that incident to North Korea's TraderTraitor activity. Bybit's CEO reported that approximately 72% of the funds had moved through THORChain.

Similar routes do not prove identical actors. In a service-based laundering economy, different attackers may use the same bridges, mixers, OTC intermediaries, and chain-hopping specialists. The more defensible conclusion is often that the evidence indicates shared infrastructure or laundering relationships, while ultimate attacker attribution remains open.

6. What an investigator should preserve and produce

For counsel or a financial institution, the deliverable should be more than a colorful flow chart. A defensible package should include:

A UTC-normalized incident timeline

Original and revised loss calculations

Source-address and destination-address schedules

Every relevant transaction hash

Smart-contract call data and decoded event logs

Bridge, swap, and refund records

Pass-through value reconciliations

CoinJoin entry-point analysis

Address-clustering methodology

Confidence levels for labels and attribution

Freeze and dwell-time analysis

Off-chain preservation targets

A clear distinction between fact, inference, and opinion

The report should also state what remains unknown. A missing identity is not a reporting failure if the evidence does not support one. It is a finding.

7. Honest limits

Blockchain forensics can reconstruct movement, timing, protocol interaction, and the boundaries of commingling. It cannot independently prove who operated every wallet, who authorized an internal command, or who ultimately owns each CoinJoin output.

That is why effective stolen crypto recovery combines on-chain records with exchange records, vendor logs, device evidence, communications, and legal process. The durable objective is not merely to follow the money. It is to produce a documented, reproducible account of what happened, what can be attributed, and what preservation targets remain available.

That is the standard StonePath Investigations applies when translating complex transaction activity into structured investigative evidence for counsel and financial institutions.