How Bitget's $387.5 million hack unfolded

An attacker stole $387.5 million from Bitget, a cryptocurrency exchange, on 24 September 2026, taking funds across 13 blockchains. Bitget’s incident statement gives the loss. Its updated timeline says a compromised wallet backend was used to trigger fraudulent withdrawals.

Much of the stolen ETH and XRP became Bitcoin through swap services. The money then travelled through bridges, coinjoins and Zcash’s private pool. The public transfers establish each visible step; links across privacy tools are marked as inferences. Amounts at successive stages describe the same money and are counted once.

Update, 10 October, 21:00 UTC: both new pools were emptied through nine hops of wallets created in advance, and $3.5 million of USDD is resting at the end of one chain

• The two pools took 10,953,043.75 USDT ($10.95 million) in all, 8,327,678.46 USDT ($8.33 million) from the 113 listed wallets and 2,625,365.29 USDT ($2.63 million) from 32 more that arrived through two further splitters funded with USDD from outside the route above, and both were emptied the same day through nine hops of wallets created before the money reached them. Pool two was drained between 03:35 and 05:51 UTC while it was still filling, pool three between 06:58 and 16:25 UTC. 145 fresh wallets sold the JWYT token into the pairs for the lending tokens, redeemed 40,028 to 97,714 USDT each at JustLend and paid 20 collectors, which paid two hubs: TJSXWa32… took 5,502,107.37 USDT from pool two’s exits and its liquidity provider, and TRPtj6gg… 6,552,267.48 USDT from pool three’s. From the hubs the money went through ten, ten, ten, ten and four wallets into two, TFWBUJQN… with 5,501,824 USDT and TF6XCZvW… with 6,552,048 USDT, every wallet past the hubs created in batches at 03:24 to 03:27 UTC and 06:52 to 06:57 UTC on 10 October or at 15:05 to 15:07 UTC on 9 October. Both swapped their USDT into USDD at the stablecoin’s swap module. TF6XCZvW… still held 3,499,645 USDD ($3.5 million) at 20:30 UTC, and the other 8.55 million USDT was swapped back between 08:18 and 16:11 UTC and paid on, through up to four more fresh wallets, in lots of 100 to 1,999,900 USDT into eight wallets with earlier histories that handle other people’s money as well. The exits.
• 1.2 million USDT came back from TRON to Ethereum on the evening of 9 October, became DAI, and went through THORChain into 14.44 BTC ($1.2 million) on three listed addresses; two of the three coins it was gathered into, and 3 BTC of the third, went into coinjoins of the equal-output kind. Thirteen fresh wallets Bitget lists took 1,199,182 USDT ($1.2 million) from the USDT0 bridge between 18:02 and 19:38 UTC, sold it for DAI on CoW Swap, and 0xf9f00af3… sent 1,213,490 DAI ($1.21 million) into THORChain in 64 deposits by 20:30 UTC, 15,292 DAI of it refunded and sent back in; the payouts were gathered into coins of 5.0, 5.0 and 4.44 BTC ($414,795, $414,795 and $368,338) by 21:21 UTC, and two of them went into such rounds at 22:15 and 22:36 UTC that night. The third reached the listed bc1q0s4g2497sd… at 03:36 UTC on 10 October and was paid on at 15:15:21 UTC ($414,795); the recipient split it into 3.0 and 2.0 BTC, the 2.0 BTC ($165,918) sits at bc1qrkvxkucr…, listed, and at 16:03:47 UTC the 3.0 BTC ($248,877) was one of 15 inputs to a 170.43 BTC ($14.14 million) round that paid eight equal outputs of 2.99675757 BTC ($248,608) and seven of change. The DAI route.
• Five more of the 7 October capital-letter payouts have been spent: two together at 23:41 UTC on 9 October into 0.87762325 BTC ($72,807), which went into an equal-output coinjoin at 05:14 UTC on 10 October, and three together at 14:58:53 UTC on 10 October into 1.34824667 BTC ($111,849), unspent at 20:30 UTC. Seven of the 33 payout addresses have now been emptied, and the other 26 held 9.79590110 BTC ($812,658) at 18:00 UTC. The gatherings.
• Balances at 18:00 UTC. The hub bc1q3vycf72… still held 20.962 BTC ($1.74 million), the three 100 ZEC orders at NEAR Intents were still held with nothing refunded, and Bitget’s ledger counted $334.80 million held and $50.25 million untraced, with 5,474 listed addresses.

Dollar quotes use the dated prices.

What Bitget has said

Bitget’s count of the loss has changed as it found more of the thefts. Its tracing dashboard values each theft at prices from the time.

Bitget names t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG as the main Zcash recipient and TBWNguTTgezw9dVorX441C6nDrZpRxYwKD as the main TRON recipient.

During a three-hour livestream on X, Gracy Chen said Bitget suspects North Korean attackers exploited a backend system used to process wallet transactions, Fortune reported on 25 September. She said the attackers tricked Bitget’s internal approval system into authorising the transfers. The attribution is Bitget’s own; Chainalysis made the same attribution on 1 October.

Mandiant and SlowMist are working with Bitget, and their reports, released on 30 September, are summarised below. The exchange says the vulnerability has been fixed and that some affected assets have been frozen through coordination with industry partners. Its recovery bounty pays 5% of funds frozen, or 5% of funds recovered, to an eligible person or entity whose voluntary action brings that about, under the programme’s terms; actions under legal processes are excluded. Suspected funds can be reported through its recovery portal.

On 26 September, Bitget announced phased withdrawal restoration. It said user balances were unaffected, its Protection Fund covered the financial impact, and trading and deposits continued. Bitget confirmed completion of that plan on 2 October.

Bitget says a compromised backend got its wallets to sign

Gracy Chen said at 00:43:40 UTC on 25 September that the attacker compromised a critical backend system in the exchange’s wallet infrastructure, spoofed transaction data and triggered its authorisation process. She said private-key compromise had been ruled out and that the initial intrusion method was still under investigation. These are Bitget’s findings; its bounty notice of 25 September says its investigation and tracing efforts remain ongoing.

Bitget’s updated written timeline, published alongside the 28 September AMA, gives the response times below. It says a third-party security product may have exposed high-level credentials used for fraudulent withdrawal commands. The investigation remains preliminary; Bitget says private-key compromise has been ruled out and cold wallets were unaffected.

The chain records independently time the principal recipient’s initial 0.84 ETH funding at 18:31:11 UTC on 24 September and Bitget’s cold-wallet transfers from 20:40:03 UTC. Bitget confirmed its withdrawal-restoration schedule on 26 September.

A wallet backend prepares and routes payment requests. A signer uses a private key to approve the resulting transaction. If a compromised system can persuade that signer to approve an attacker’s destination, the blockchain receives a valid signature on a malicious payment.

The original transfers we examined were authorised by their source accounts. On the Ethereum-compatible chains, the selected set contains 11 native-asset transfers and five direct token transfers. The XRP payments carry signatures and the source accounts’ public signing keys. That establishes that the relevant signing authority was used. A public transaction alone cannot show whether someone copied a key or caused an existing signing system to use it.

Bitget’s emergency move of its own funds to safety began at 20:40:03 UTC on 24 September and reached at least 34 chains in 4 minutes 23 seconds, to 20:44:26. On Solana it moved 35,045 SOL (about $4.25 million at the time), 27.85 million USDC and 20.52 million USDT ($48.37 million together); on Plasma, 28.88 million USDT0 ($28.88 million); on BNB Chain, 30.56 million USDT ($30.56 million); and on TRON, 40.54 million USDT ($40.54 million). The last thefts, the TIA at 21:23:01 UTC and 223.2 ETH from the wallet labelled Bitget 6 ten seconds later, came 43 minutes after the sweep began, from wallets it had yet to reach.

Mandiant and SlowMist found a web shell and a custom withdrawal tool

Bitget released both investigators’ reports at 05:20 UTC on 30 September, saying both “identified the compromise of third-party security products that ultimately enabled unauthorized access to Bitget Exchange’s wallet environment”. The reports call the products A and B.

Mandiant’s status report, dated 28 September, says that on 24 September the attacker gained privileged access to two third-party security appliances, deployed a web shell on one of them with a command-and-control connection, moved from it to Bitget’s production wallet job server and deployed malicious packages there. It adds that the thefts ran alongside legitimate wallet operations on Ethereum until about 21:23 UTC, almost three hours after the first unauthorised transfers, and that its investigation continues.

SlowMist’s progress report, covering its work to 29 September, finds the earliest malicious activity in the available logs on 31 August. Its findings, with dates as SlowMist gives them and clock times converted from UTC+8 to UTC:

The 93 TRX test at 18:31:00 UTC, the 0.84 ETH eleven seconds later and the 223.2 ETH at 21:23:11 UTC, all on this page, match the report’s first and last transfers to the second.

Bitget’s incident page, last updated on 30 September, says the attack involved 12 wallet addresses, that its Protection Fund holds 5,500 BTC, worth more than $464 million, and that 9,585 Bitcoin withdrawals, about 4,098 BTC, were processed in the first hour after BTC withdrawals reopened on 28 September. Chainalysis, which says it is working with Bitget and law enforcement, attributed the theft to North Korea on 1 October: “DPRK-attributed threat actors stole $387 million from cryptocurrency exchange Bitget.”

Bitget’s logs can explain how those requests were approved

The next decisive evidence is the exchange’s own sequence of balance reads, withdrawal requests and signing approvals. Investigators can search for the exact older balance 2,498,746.151375 XRP, the failed 9,142,093.8 XRP request, and the later successful request after funds arrived.

Those records can show which system supplied the destination, when each amount was calculated, and which authorisation checks accepted it. They would turn the observed payment pattern into a tested explanation of the breach. The public ledger gives investigators specific transactions to reconcile with those internal records. Our exploit-tracker record keeps the incident figure and key transaction links in one place.

The attacker hit 13 blockchains

Bitget’s tracker lists thefts on 12 blockchains, and Injective is the thirteenth. We checked Bitget’s published wallets on about 70 chains for anything that left between 18:30 and 23:00 UTC on 24 September, and every other theft we found is on the tracker, across 11 of them: Ethereum, Arbitrum, Optimism, Base, BNB Chain, Avalanche, the XRP Ledger, TRON, Zcash, Algorand and Celestia.

The twelfth, added by Bitget on 27 September, is 647,649.9 ATOM ($1.21 million), taken from its Cosmos Hub hot wallet at 21:22:55 UTC on 24 September and swapped through THORChain into Bitcoin on 25 September. The Bitcoin routes traced on this page began with swaps of stolen assets.

The thirteenth is Injective. At 19:01:29 UTC on 24 September, three seconds before the drain of Bitget’s XRP hot wallet, an Injective hot wallet sent 553,158.72 INJ ($4.13 million) to a new address, the only payment that wallet made during Bitget’s INJ suspension from 24 September to 2 October. Injective’s validator notice says Bitget reported the compromise and asked for help recovering its funds, and the on-chain blocklist Injective added in response has held the receiving key since 28 September, with 537,450.64 INJ ($4.01 million) still on it. Bitget’s tracker has no Injective row. INJ values are at CoinGecko’s $7.46 on 7 October.

On chains where Bitget publishes no wallet addresses, including Litecoin, Dogecoin, NEAR, Stellar and the other Cosmos chains, the count rests on Bitget’s own list.

Our first count found $350.66 million on six networks and XRP

Our first reconstruction counted 16 transfers across Ethereum, Arbitrum, Avalanche, Base, BNB Chain and Optimism, plus three successful XRP payments. It counts each original receipt once and follows later movements separately.

The reconstruction prices everything at 21:39:35 UTC on 24 September, including XRP at $1.53482820, with a gold-price proxy for XAUT and a USDT-price proxy for USDT0. The token quantities are separate ledger measurements. The calculation and evidence index records the inputs. Bitget’s first $351.6 million estimate was broadly consistent with it, its revised $387.5 million adds the Zcash and TRON transfers, and the tracker’s list adds the ALGO, TIA and ATOM. The EVM basket includes an initial 0.84 ETH funding payment whose classification as stolen funds is provisional.

Bridges and collectors carried ETH back into the main wallets

The secondary wallet, 0x7c96279Ec1e888Aa56b9B836e0dB26ca48573E1C, swapped 1,000 BNB on 24 September, then used Across to send the proceeds to the same address on Ethereum. The destination received 286.005857909746987778 ETH just 29 seconds after the source transaction.

The earliest verified Ethereum funding of the principal recipient is 0.84 ETH from an account labelled Bitget 6, at 18:31:11 UTC on 24 September. A later 0.1 ETH payment links it to the secondary wallet. Swaps and public bridge services describe the route; naming a person or group needs more evidence.

On Optimism, 495.625 WETH moved from the tracked wallet at 02:29 UTC on 25 September, and the tracked funds then crossed to Ethereum. At 02:55:13, 1,300,000 USDC was burned on Optimism, and ten seconds later the recipient received 1,299,812.601649 USDC net, with 187.398351 USDC paid as a fee from the 1,300,000 USDC minted on Ethereum through Circle’s CCTP, which burns USDC on one chain and mints it on another. At 03:02 the USDC was swapped for 483.61 ETH (about $1.30 million), which passed through two wallets and reached 0x52f08…25d284 at 03:45:47.

The same collecting wallet, 0xA6dD3F218B65E32Ccc37BE30f74884133c655545, fed 0x52f08… again on 26 September. It received 170.465 ETH from 0xe07bd590… at 02:23:35 UTC and the 457.896 ETH provisionally linked to the TIA deposits from 0x48857fc6… at 02:26:23, then sent 628.36 ETH (about $1.69 million) to 0x52f08… at 07:59:59. 0x52f08… is one of the eight big holding wallets and held 4,326.46 ETH (about $11.63 million) at the earlier snapshot. It sent 4,326 ETH onwards at 11:52 UTC on 28 September, as recorded in the earlier balance snapshots.

Two of the eight ETH wallets started moving on 27 September

Hoard wallet 1, 0xd2c2f029eFF5caCc686F24377CfdDcfc82d9F899, the first of the eight ETH wallets to move, sent all 10,000 ETH ($26.86 million) in 75 transactions between 07:40 and 20:06 UTC on 27 September. Its ETH took a long road into Bitcoin:

1. The ETH is swapped for USDC on CoW Swap, ParaSwap Delta or Skip Go, three services that route trades across exchanges.
2. Circle’s CCTP, which burns USDC on one chain and mints it on another, moves the USDC to Noble, a Cosmos chain, and on to Arbitrum.
3. On Arbitrum the USDC is swapped back into ETH.
4. The ETH goes into Chainflip deposit channels, and Chainflip pays out Bitcoin.

The second, hoard wallet 2, 0x600cfedc6bd65fa79b604dc44964f419e45784b2, received hoard wallet 1’s last 110.99 ETH at 20:06 UTC and made five sends of its own between 20:08 and 20:58 UTC. From 22:43 UTC it began feeding 0xbc3b7250cc94c70d0b56bf4bcf83fd0bf0ef2508, a relay wallet that had already passed on 223.07 ETH from hoard wallet 1 at 19:15 UTC: 76.15, 76.40, 163.79 and 31.08 ETH ($933,024 together) by 01:18 UTC on 28 September, and the relay sent 316.33 ETH ($849,540) on to a fresh wallet at 01:11 UTC. Hoard wallet 2 held 8,920.65 ETH at 01:30 UTC and 7,561.29 ETH ($20.06 million) at 04:28 UTC, after twelve more sends that the morning sections below follow. At that 04:28 UTC snapshot, the other six had yet to send a transaction and held 48,922.93 ETH ($129.82 million). Later movement, including 4,326 ETH from 0x52f08… at 11:52 UTC, is recorded below.

The evening chase: $830,000 through seven stops in an hour

The second wallet’s first batch took a new route on the evening of 27 September, with each stop lasting between two and 17 minutes:

1. 20:45 to 20:58 UTC. ETH was swapped for USDT on CoW Swap, and USDT0, Tether’s cross-chain token, carried it to TRON. 399,800.02 and 430,915.43 USDT landed at TNnaMomtQsYHBRCxvF69Gdf3QbT48mZnxE at 20:53 and 21:02 UTC.
2. 21:04 UTC. 830,715.45 USDT was sent straight back to Ethereum and landed at 21:06:47 as 830,466.24 USDT in a fresh wallet, 0xc7328815c76381ae53249e0285e2a1bca8ae4544.
3. 21:10:47 UTC. The wallet swapped it on CoW Swap for 830,295.18 USDC.
4. 21:13 to 21:16 UTC. 430,295.18 USDC was swapped 1:1 into DAI through Sky’s USDC-DAI swap, out of Circle’s reach, and sat in 0xc7328815… until 23:29 UTC. The other 400,000 USDC went through a fresh wallet, 0x21865172…, and on at 21:17:59 to 0x2dea6d4a262b25fe3532c1f6964090b4a2a5e4f3 (transfer).
5. 21:23 to 21:36 UTC. 0x2dea6d4a… sent the 400,000 USDC out in seven orders of $12,000 to $75,000 through Skip Go Fast, a fast cross-chain USDC service, each naming noble1aaxlm5k00ruqzjnd07htjklag85aydufc2semw on Noble and then dydx1aaxlm5k00ruqzjnd07htjklag85aydufest4rh on dYdX’s own blockchain. On dYdX each chunk sat in a trading account for about 20 seconds before it was withdrawn to noble1wv9g8le93nzyuyh2laj6fffesm7h5jj9yqps7r on Noble, which held 332,426.71 USDC at 21:38 UTC.
6. 21:41 UTC. noble1wv9g… sent 399,997.75 USDC to noble1g0jljwpkmk909y4zaj6mlghsrradslsape53jd, which used Circle’s CCTP to send 399,959.99 USDC to Arbitrum (Noble transaction).
7. 21:42 UTC. 399,959.99 USDC ($399,960) landed at 0x710cf8d1e0264b4a3fc4483c63c902e43a5d608b on Arbitrum, a wallet that had never sent a transaction.

The gas came from KuCoin. At 21:47:08 UTC the Arbitrum wallet received 0.0137518 ETH ($37) to pay its fees from 0x03e6fa590cadcf15a38e86158e9b3d06ff3399ba, which Arbiscan labels a KuCoin hot wallet and which has made more than a million transactions. That reads as a withdrawal from a KuCoin account, and KuCoin holds the record of who asked for it.

Four minutes later the money split. At 21:51:38 UTC the Arbitrum wallet swapped 200,119 USDC for 200,000 DAI ($200,000) on CoW Swap. At 21:52:11 UTC it sent 199,840.73 USDC ($199,841) through Circle’s CCTP to the chain run by Hyperliquid, a trading platform with its own blockchain, where Circle’s record shows the transfer complete. The recipient, 0xb21d281dedb17ae5b501f6aa8256fe38c4e45757, is a forwarding contract that passes these deposits into Hyperliquid’s main USDC pool.

The Hyperliquid deposit was Bitcoin 50 minutes later. Hyperliquid’s own records show the 199,840.53 USDC credited at 21:52:18 UTC to the same address as the Arbitrum wallet, 0x710cf8d1…. It was swapped for UBTC, Hyperliquid’s Bitcoin token, and by 21:55:44 UTC 2.3572887432 UBTC had been passed to a fresh account, 0x24e1975cfbe14fced207271f85627bc0a8dc7c31, which withdrew it at 21:56:40. The Bitcoin arrived at 1NFCQGyMXdb5BmoirSavGMHCfj2kacrmNK in a payout at 22:42:18 UTC and was moved in the same block to bc1qan99rnewuzhkm6nurzgy6er2cj6mve987ttpn0, which held 2.35709481 BTC ($199,344) and was still unspent at 21:30 UTC on 5 October. By 23:03 UTC the 200,000 DAI on Arbitrum was USDC again and on its way into Hyperliquid by way of Solana, and at 23:29 UTC the 430,295 DAI on Ethereum followed. The overnight section below has where they ended.

A side branch from hoard wallet 1 ended in Bitcoin and DAI too. 0x7381800cb1AE92A50aAeE4E164A5598da24f56F2, which Bitget’s tracker flags, received 58.10 ETH ($156,145) at 16:41 and 16:44 UTC, 39.14 ETH of it straight from hoard wallet 1, and turned it into about 156,000 USDC. Most of that, 125,997.90 USDC, went through Noble and Arbitrum back into ETH and through Chainflip into Bitcoin, 1.7006839 BTC ($143,830) at bc1q0t9grnhtmdg5s7d0wuz2fksu3cg289jd447sl7, still unspent at 21:30 UTC on 5 October. Its last 9,999.18 DAI went at 22:41 UTC to 0x54328634060788df7d98b3B3b1E347235C4Eb113, which held 162,037.03 DAI ($162,037) at the 28 September check.

One wallet paid the gas for six of the laundering wallets. 0x5b73874c45Da455E73D677D863fbeDA26f902289 funded six wallets with gas on 27 September, including 0xc7328815… and 0x2dea6d4a… from the evening chase. It was itself funded at 16:20:47 UTC with 0.07326845 ETH ($197) from 0x4E5B2e1dc63F6b91cb6Cd759936495434C7e972F, which the Blockscout explorer labels FixedFloat’s hot wallet and which has made about 3.44 million transactions. FixedFloat is an instant crypto swap service, and its record of that order shows what paid for it. The attacker had used FixedFloat before: between 08:00 and 08:08 UTC on 25 September, two wallets on Bitget’s attacker list sent 60 BNB ($46,345) to four FixedFloat deposit addresses, and at 12:14 UTC 1,000 XRP ($1,520) went to FixedFloat’s XRP account with destination tag 345292.

At the 28 September check, Tether and Circle’s freezes were unchanged since 25 September. Along the way the attacker’s wallets received zero-value transfers from lookalike addresses and fake “USDT” transfers, the marks of address poisoning.

Overnight the DAI went back into Hyperliquid, and $1.86 million more was parked

Between 23:02 UTC on 27 September and 01:31 UTC on 28 September, the attacker turned both DAI holdings from the evening chase back into USDC and ran them through Hyperliquid into Bitcoin, then set aside a much larger DAI position from a fresh sale of ETH.

The 400,000 USDC Noble route still ends in 4.72844203 BTC. At 14:09 UTC on 1 October, the first Bitcoin wallet held 2.35709481 BTC, and the second held 2.37134722 BTC. Both balances were unchanged and unspent since 27 September. Unit’s completed withdrawal records connect the first payout and the second payout to the Hyperliquid accounts in this route.

Every Hyperliquid deposit followed the same pattern: credited to the depositing address within seconds, swapped for UBTC, Hyperliquid’s Bitcoin token, and withdrawn to a fresh Bitcoin address. At the morning check on 28 September, 14.74 BTC ($1.23 million) had come out of Hyperliquid through Unit, its Bitcoin bridge, this way, to four addresses that still held their coins at that check: 4.93 BTC at bc1qmf484k7…, which Bitget’s tracker carries with a Unit label, and 2.36, 2.37 and 5.08 BTC at bc1qan99…, bc1qzjpny… and bc1q3c06k7…, which sat beyond its map at that check; Bitget has since listed all three as Unit withdrawal collection addresses, and all three were still unspent at 21:30 UTC on 5 October. At that morning snapshot, the tracker followed these deposits into Hyperliquid’s bridge contract on Arbitrum; its list added ten downstream Unit-route addresses later in the day. Unit’s public record of every withdrawal names the Hyperliquid account behind it.

The DAI position was 2,482,049.61 DAI at 01:31 UTC, across four wallets: the 1,857,483.24 above, 395,862.06 at 0xfF37166D… from 21:06 UTC on 27 September, 162,037.03 at 0x54328634… and 66,667.28 at 0x030F43Ce…. By 04:28 UTC it was 4,242,154.18 DAI ($4.24 million) in nine wallets, after hoard wallet 2’s morning sales, which the next section follows. No issuer can freeze DAI. Bitget’s tracker puts $26,866 of the attacker’s stablecoins within an issuer’s reach.

Hoard wallet 2 paid out 1,359 ETH before dawn

Between 01:33 and 04:28 UTC on 28 September, hoard wallet 2 made twelve sends totalling 1,359.36 ETH ($3.61 million), taking it from 8,920.65 to 7,561.29 ETH. Most of it was sold within minutes on CoW Swap: 662.11 ETH for 1,760,104.57 DAI, an average of $2,658.35 an ETH, parked in five new wallets; the first sale, at 01:40 UTC, turned 140 ETH into 373,321.02 DAI. 419.29 ETH went at 04:05 to a transit wallet that feeds THORChain (next section), 33.85 ETH sat at the relay, and a 42.47 ETH parcel was pulled back from two CoW orders the attacker placed and then cancelled within 13 minutes; it sat at 0xe58b5b0b… at the 04:28 UTC check.

At 04:28 UTC none of the nine wallets had spent its DAI. The five morning sales received 1,760,104.57 DAI for 662.11 ETH, an average of $2,658.35 per ETH with DAI valued at $1. Assessing execution costs requires contemporaneous quotes and transaction fees; the later Chainlink reading alone cannot establish those costs.

ETH went through THORChain in 100 ETH orders

The 29 September drain from the remaining hoards used the same route on a larger scale. By the 14:49 UTC check, 18 hop wallets had made 143 deposits totalling 10,146.55 ETH through THORChain’s Ethereum router and 83 further deposits totalling 2,049.62 ETH into its vaults: at least 12,196.17 ETH, about $33.16m at the stated Chainlink price. Of the 226 deposit memos, 120 had been read at the check, and each requested Bitcoin and named a payout address already on Bitget’s list. Six of those Bitcoin payout addresses sent 258.4 BTC onwards after 03:20 UTC, all to addresses Bitget also listed at the check. That six-address follow-up establishes those sweeps, while the other deposits and later payouts need their own settlement checks. One named payout address had received 197.79 BTC in total by the afternoon reading and had passed nearly all of it on. Other observed payments from the hop wallets sent 11,184.36 ETH to Bitget-listed downstream wallets and 14,956.22 ETH between the hop wallets themselves. Those flows overlap as funds pass through multiple addresses and must not be added to the 26,043.63 ETH hoard outflow.

Two further hop-wallet payments, 150 ETH to 0xc5038360… and 1 ETH to 0xc53ae447…, went to wallets outside Bitget’s list at the earlier check. By our 15:05 UTC recheck Bitget had added the 150 ETH recipient. The 1 ETH recipient was still absent and had forwarded its balance; its next destination was still to be established at that check.

At 03:55 UTC on 28 September a transit wallet, 0xf7bc92103f23ef312658cd9b81dc2713f7b396c3, began paying ETH into THORChain’s Ethereum vaults in round lots: 1 ETH first, then 100 ETH every one to three minutes. By 04:28 UTC it had made 13 deposits totalling 1,118.80 ETH ($2.97 million), topped up by hoard wallet 2 with 419.29 ETH at 04:05. Every deposit carries the same instruction in its data: swap to Bitcoin in 255 pieces and pay bc1qvqja3gaa73ku037yutpt6h8l788rva70cqj68f, a fresh address that held 6.84 BTC ($569,571) by 04:28 with more in the mempool. THORChain streaming swaps execute internal sub-swaps over time and aggregate the result for the outbound payment. These separate orders complete at different times, so the tracker’s “in flight” figure rises with deposits and falls as completed payouts land.

Two sister wallets ran the same play from 04:02 UTC: 0x858abaf4… paid 90.99 ETH in nine deposits of about 10 ETH for bc1qqmp67f0…, and 0xedf18488… paid 58.88 ETH in six for bc1qm2z32nx…. The Bitcoin addresses are named in the deposits themselves, and Bitget’s tracker carried two of the three by 04:30 UTC.

The 151 ETH behind those two wallets came from hoard wallet 1’s money by a route the attacker rehearsed first. At 02:25 UTC, 10 ETH went from Ethereum to Arbitrum and back, through Umbra, a privacy tool that pays to one-off stealth addresses, to Arbitrum and back again, then to Linea by deBridge and back by deBridge: eight hops in 50 minutes. At 03:31 UTC, 151 ETH followed the last two hops, through Umbra to 0x858abaf4… and into three deBridge orders to Linea. Two orders of 30 ETH filled in about 30 seconds. The 45 ETH order sat unfilled for 16 minutes; at 03:55 UTC the attacker cancelled it from Linea, and at 03:59 deBridge refunded it on Ethereum. The 59.95 ETH that had reached Linea came straight back through Stargate to 0xedf18488… by 04:09 UTC, and both wallets turned to THORChain. A 1 ETH test payment from 0xedf18488… at 03:21 went to a wallet that sweeps into an exchange-style deposit chain.

Hoard wallet 2 is refilled from the other hoard wallets as it drains: 4,326 ETH at 11:52 UTC from 0x52f08feb…, down to 1,884 ETH by 13:50, up to 5,439 by 15:15, 3,821 at 16:58 and 2,722 at 17:46. Since 08:10 UTC Bitget’s own feed shows the ETH leaving three ways: 1,731 ETH ($4.67m) into THORChain between 12:20 and 13:38, 1,232 ETH ($3.32m) through CoW swaps since 08:10, and about $5.1 million through Stargate and LayerZero to Arbitrum, with $4.1 million bridged on again from there and some of it surfacing on Linea. On the Bitcoin side THORChain paid the attacker 93.52 BTC ($7.80m) and Chainflip 38.33 BTC ($3.20m) between 08:10 and 13:50, all to addresses on Bitget’s list.

ETH became Bitcoin through tBTC and Hyperliquid

From 04:09 UTC on 28 September the attacker opened a second exit for the ETH, and Bitget’s tracker misreads its first step. Thirteen wallets on Bitget’s list, fed by hoard wallet 2, had sent 1,079.43 ETH ($2.91m) by 13:50 UTC into a contract called OnchainGateway, which Bitget’s feed logs as a bridge carrying the funds out of Ethereum. It is a swap router: each call routes the ETH through WBTC, USDC, USDT and Curve pools into tBTC, Threshold’s Bitcoin-backed token, and pays it to a fresh Ethereum address. Thirteen fresh addresses had received about 11.8 tBTC by 07:42 UTC, every one absent from Bitget’s list at the time, and the coins never left Ethereum at that step.

Unit’s public record of each withdrawal names the Hyperliquid account behind it, and the records show one more habit: the same accounts paid 0.007 to 0.014 ETH of gas to each fresh Ethereum wallet before it was used, and two of them funded two more wallets at 07:37 and 07:53 UTC, ready for the next round.

Each Unit payout is then cut into round parcels within hours, the shape of the 2 BTC that reached THORChain at 05:20: 2 BTC to bc1qjqpljmg…, bc1qwj06cr4… and bc1q4lxuu37… overnight and 1 BTC to bc1q77v8vwu…, then 2 BTC to bc1qt6hrv75… at 10:32, 2 BTC to bc1q653lrgd… at 13:28, and, in the mempool at 13:55, 2 BTC to bc1qfca8ahde… and a first 5 BTC parcel to bc1q80euklg…. Bitget’s list caught up with the route during the day: by 18:05 UTC it carried the three Unit payouts of 27 September, Unit payout address B, five of the parcels and one change output, which it labels as Hyperliquid-to-Unit withdrawals and new downstream addresses at hops 12 to 14. The route ran on through the afternoon: seven more Hyperliquid accounts were fed by the routing contract between 16:12 and 16:40 UTC, Unit paid four more fresh addresses in batches through to 18:00 UTC (bc1q7ve8a2p2…, bc1qnn8nepfd…, bc1q3hc992jy… and bc1qcd9g864u…, holding 7.77 BTC between them at 18:05), two of those payouts were cut into a 4 BTC parcel at 15:05 and a 3 BTC parcel at 16:03, and Unit payout E was cut at 16:28 UTC into a first 3 BTC parcel, bc1qk0ugs9pv…. Parcels a, c and e, the 4 BTC parcel, the two 3 BTC parcels and the four new payouts were still beyond Bitget’s list at 18:05; its list has since taken in the four new payouts and the first 3 BTC parcel.

The 2 BTC that went into THORChain at 05:20 UTC came out at 12:30 as 495,890 TRX ($0.17 million) at TW49e9PG…, which sent 495,880 TRX ten minutes later to a wallet created that minute, TRGeSQveGZ…. Four swaps through a TRON exchange contract turned it into 166,064 USDT by 12:44, and at 12:47 166,000 USDT went to TWzqWeKX…, an address open since 29 June that held 564,778 USDT at 13:53 UTC, the shape of a desk. The 0.1 BTC swap into TRON USDT from 06:51 was refunded to its sender.

CoW and Chainflip converted ETH into Bitcoin

From 22:05 UTC on 28 September, another ETH route ran through CoW Swap, USDC and Chainflip. The source wallet, 0xf7bc9210…, is on Bitget’s attacker list. It funded 0x8150a1fc… with 417.34 ETH at 22:03, 387 ETH at 23:03 and 204.27 ETH at 23:26. Bitget’s 18:36 UTC address map ended at the funding wallet; it has since listed both sellers.

By 00:15 UTC on 29 September this seller had placed 17 CoW orders totalling 1,412.2 ETH and passed its last 204.8 ETH to a second seller, 0xb56ede97…. The second seller sold another 100 ETH at 00:24 for at least 266,410.11 USDC, paid into Chainflip channel 732865 for bc1qa0rjjhyu…. At 00:32 it sent its other 104.8 ETH to 0x40874361…, which had passed it on by 01:06. Across both sellers, 18 orders sold 1,512.2 ETH (about $4.05m at the 00:55 Chainlink ETH price).

At the earlier 23:37 UTC snapshot, the first seller’s eleven recorded CoW orders from 22:05 to 23:27 totalled 811.4 ETH; the first order sold 1 ETH. The fills sent about 2.18m USDC along two paths:

1. The first five fills paid 832,277.58 USDC to 0x7850a1b2…. Four larger sends crossed to Arbitrum through Stargate and entered Chainflip deposit channels there.
2. From 22:52 UTC, six more fills paid 1,344,672.77 USDC directly into six Chainflip deposit channels on Ethereum. Each channel swept its USDC into Chainflip’s shared Vault within minutes.

The Chainflip explorer records the deposit channel and Bitcoin destination for each swap. The ten matching channels were opened minutes before these deposits; their records direct the payouts to the four addresses below. Chainflip reuses deposit addresses. The matching channel opening times and deposits identify this route; older uses of those addresses belong to earlier swaps.

At the 23:37 UTC snapshot, that was 22.57749612 BTC confirmed, plus 3.19966078 BTC awaiting confirmation. The confirmed payouts were swept into four fresh Bitcoin addresses, which held 24.93648396 BTC together at 23:36 UTC. The first sweep combined the two smaller Chainflip payouts with 2.35902192 BTC from three other inputs; its full output therefore exceeds the proceeds established for this route. Three more sweeps carried the larger payouts at 23:00, 23:15 and 23:28 UTC. Those four sweep addresses sat beyond Bitget’s 18:36 UTC map.

Nine Bitcoin sweep addresses by 01:06 UTC

The route continued overnight. Chainflip’s channel records identify the Bitcoin payout addresses, and the Bitcoin transactions show further payouts being paired and swept into fresh addresses. At 01:06 UTC on 29 September, eight confirmed sweep outputs and one unconfirmed 6.55816616 BTC sweep totalled 57.12405458 BTC (about $4.77m at the 00:40 Chainlink BTC price). None of the nine outputs had been spent, and none of their addresses appeared on Bitget’s 18:36 UTC list. This is a balance of traced Bitcoin outputs, not a conversion value for the 1,512.2 ETH sold: the first sweep also gathered earlier payouts.

Five further Bitcoin sweeps by 03:21 UTC

The same Chainflip payout address sent five further sweeps to fresh wallets between 01:25 and 03:00 UTC on 29 September. The Bitcoin outputs totalled 36.38530826 BTC, about $3.02m at the 02:09 Chainlink price. Each receiving wallet still held its output when checked after 04:26 UTC. A Bitcoin sweep can combine more than one earlier payout, so its output amount is a traced wallet balance rather than the net proceeds of one ETH order.

By 14:49 UTC, Bitget had added the five wallets above and the earlier Chainflip sweep wallets to its address list. The route’s payout address bc1qa0rjjhyu… had received 74.97 BTC in total and passed it onwards, leaving no balance there. Chainflip was still in use that afternoon: four deposit channels opened from 14:13 to 14:44 UTC for Bitcoin destinations Bitget also lists. These later channels show continued use of the service; the earlier 57.12 and 36.39 BTC tables remain dated balances, not extra funds to add to the current tracker.

The attacker put 9.5 ETH into Tornado Cash

The attacker put 9.5 ETH ($23,677) into Tornado Cash in 14 deposits, 13 of them between 13:53 and 14:09 UTC on 30 September and the last at 16:11 UTC on 4 October. Every deposit came from 0x6d1ee681…, which Bitget’s tracker lists as the attacker’s at five hops from the theft, and went through Tornado Cash’s router into its 1 ETH and 0.1 ETH pools.

The wallet was funded with 0.11 ETH ($274) and 9.38 ETH ($23,378) on 30 September by 0xd9154200…, another wallet on Bitget’s attacker list, minutes before each run of deposits, and with 0.06 ETH ($150) on 4 October by a one-hop relay wallet, 36 seconds before the last deposit. Each deposit is a confirmed transaction, so the route into the pools is established. A Tornado Cash pool pays a withdrawal to any address that proves it holds one of the pool’s deposits, without saying which one, so the trail of these 9.5 ETH runs into the pools. It is a small sum next to the theft, about 0.006% of $387.5 million.

A failed 9.14 million XRP payment exposes an older balance

The account labelled Bitget 2 held 101,578,825.284121 XRP immediately before its large withdrawal on 24 September. At 19:16:20 UTC, it sent 91.42 million XRP, or 90% of that balance, to the attacker’s recipient account. About 10.16 million XRP remained. At 19:28:02, 2 million XRP moved from Bitget 2 to Bitget 1, another exchange-labelled account, leaving about 8.16 million XRP in Bitget 2.

An hour later, at 20:28:20, Bitget 2 attempted another payment to the attacker, this time for 9.14 million XRP. It had only 8.16 million XRP available, so the ledger rejected the payment with tecUNFUNDED_PAYMENT. The attacker received zero XRP from this attempt; the source wallet paid a 0.000020 XRP transaction fee.

The failed request was sized as though the earlier 10.16 million XRP balance still applied. Its exact amount, 9,142,093.8 XRP, equals 90% of the earlier balance after rounding that balance down to whole XRP. The intervening 2 million XRP transfer explains why the wallet could no longer cover that request.

The attempt sits in the sender’s history: its recorded changes concern only the sender’s fee and transaction sequence. XRPL’s transaction-result documentation explains how a failed transaction can still consume a fee.

The evidence fits a payment amount calculated from stale balance information. It leaves several possible explanations, including an automated process, a queued request or a human choosing the amount.

More XRP arrived, then another withdrawal succeeded

At 20:40:02 UTC, Bitget 1 sent 2,183,079.516298 XRP into Bitget 2. Added to the roughly 8.16 million XRP already there, this brought Bitget 2’s balance to about 10.34 million XRP.

At 21:19:21, Bitget 2 successfully sent 9,306,865.8 XRP to the attacker. That was 90% of its total replenished balance, after rounding the balance down to whole XRP.

The three successful payments total 102.98 million XRP, exactly 102,976,680.091945 XRP, worth $158.05 million at the 24 September price above. Both internal transfers stayed between exchange-labelled wallets. The replenishment transaction proves a transfer between those accounts; its purpose and the process that started it need Bitget’s internal records.

A separate first payment of 2,248,871.536237 XRP also matches 90% of an older balance, with rounding to XRP’s smallest unit. That balance existed about 26 to 29 minutes before the payment. The preceding records from that source, and the second source’s records across the attack window, read the same on two public XRP servers.

The settings also resemble earlier exchange payments. Ten earlier outgoing transfers from the same account carry the same signing public key and the same transaction settings as the four outgoing transactions in the incident window. Those public settings can be copied. Their investigative value lies in identifying the matching requests and signing records inside Bitget. The exploit-tracker entry links the failed and successful transactions for comparison.

XRP became Bitcoin through THORChain

From 02:13 UTC on 25 September to 15:25 UTC on 26 September, accounts on Bitget’s list made 2,378 deposits totalling 63,862,237.82 XRP into THORChain vault accounts, starting with 3,610 XRP at 02:13:22. Each deposit’s memo names the asset and address THORChain should pay. THORChain sent back 6,108,439.59 XRP in refunds, so 57,753,798.23 XRP (about $89.44 million) has been swapped out. Most of it went in from the evening of 25 September onwards, in steady chunks of a few thousand XRP.

Those figures include refunded XRP that was deposited again. The ETH deposits name two wallets: 0x7cF6465c…de45DA for 4,292,081 XRP, described below, and 0x8eec4bca3d6e119fbe1778a0eae6b78c36a754c9 for 640,999 XRP. The second wallet relays straight on, holding the ETH for about a minute: at 14:35:59 UTC THORChain paid it 1.9918 ETH ($5,359), and at 14:36:59 the same 1.9918 ETH went back into THORChain, asking for Bitcoin at bc1qhkhsxr57czw5cayhvz0p2wgf2zs29d5hwcsdw6. Its memos name the same THORChain front-end account, thor199tl2t4fkxqn7pawk8dgera79dl70rnczu6jsl, which takes a 0.1% fee. The listed XRP accounts held 102.98 million XRP after the theft, 89.93 million at 21:11 UTC on 25 September, 33.43 million at 18:52 UTC on 26 September and 21.54 million at 00:17 UTC on 27 September, counting XRP mid-swap in the forwarding and worker accounts.

The attacker feeds the swaps by emptying the big holding accounts into smaller listed ones, one account at a time. rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs, which took 20 million XRP on 24 September, paid its last 1.66 million out by 00:11 UTC on 26 September and holds 22.83 XRP. r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ moved all 20 million XRP in 81 payments between 01:35 and 08:40 UTC, then deleted itself from the ledger at 14:14:30 UTC, reclaiming its reserve. rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn moved all 20 million XRP in 92 payments between 08:05 and 15:49 UTC and holds 1.57 XRP. rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw started at 15:11:10 and sent all 20 million XRP ($30.40 million) in 107 payments, the last at 23:30:50 UTC; it holds 1.50 XRP. The last holding account, r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y, untouched since 24 September, made its first payment at 22:49:32 UTC on 26 September and its last at 07:43 UTC on 27 September, which left the stolen XRP all sent on. Bitget’s tracker counted 91,602 XRP ($139,235) still mid-swap at 21:49 UTC. Both accounts pay a shared set of forwarding accounts, six of which carry about two thirds of the XRP, and those pass it to worker accounts in lots of up to 180,000 XRP. The workers send 3,500 to 4,000 XRP ($5,320 to $6,080) into THORChain every 60 seconds, each payment’s memo naming a Bitcoin address: 11:42:11, 11:43:11.

Two smaller routes carried XRP elsewhere. At 16:36:02 UTC on 25 September, a listed account sent 173,819 XRP (about $269,172) to an unlisted account, which passed it to NEAR’s XRP deposit account nine seconds later; the explorer XRPScan verifies that account as NEAR, with the domain near.com. And 16 payments totalling 49,894 XRP ($77,265) went to the Bridgers swap service, whose first 12, 33,500 XRP between 00:24:20 and 01:02:01 UTC, named three Ethereum addresses in their memos.

Since the evening of 26 September, the XRP has reached Bitcoin by three routes at once, all paying the same Bitcoin address, bc1qhkhsxr57czw5cayhvz0p2wgf2zs29d5hwcsdw6, and all through the same THORChain front-end account. Each wallet holds the intermediate coin for about a minute before paying it back into THORChain.

The BNB route takes about 6.87 BNB ($5,300) at a time, the size of one XRP lot, and was still running at 00:31 UTC on 27 September.

Those three addresses received 19.003612 ETH in 12 payments from 0xc1d13492285eb664951E201BF7C80c7c6318a1b5, which Blockscout identifies as SwftSwap, the last at 01:08:23 UTC. By 02:37 UTC their ETH had been pooled in 0x00154b…411A7, which then held 25.98 ETH after five deposits.

XRP bought ETH, and the ETH bought Bitcoin through Chainflip

THORChain has paid 0x7cF6465cDfFb584f74941E8c1FDAEd6388de45DA, an address on Bitget’s list, 2,383.10 ETH (about $6.41 million) in 232 payouts between 16:41:59 UTC on 25 September and 14:46:47 on 26 September. Each of the first 219 payouts carries the hash of an XRP deposit from a listed account in its memo. The wallet sends the ETH on in batches through Umbra, a stealth-address payment service: 22 batches and 2,485.7 ETH by 15:06 UTC on 26 September. That total includes 237.73 ETH which twelve of the wallets on the Stargate leg below sent back to it between 07:13 and 14:50 UTC and which it sent out again; it held 94.11 ETH (about $253,052) at 15:25.

The first seven batches, 886.4 ETH sent between 16:55 and 21:03 UTC on 25 September, reached Bitcoin by the steps below.

Chainflip’s records show each channel opened minutes before its deposit as an ETH-to-Bitcoin swap, paying one of eight Bitcoin addresses. The first five Bitcoin payouts were moved on within 40 minutes of arriving. The 15 later batches, sent between 22:04 UTC on 25 September and 15:06 UTC on 26 September, start the same way, through Umbra. 0x7cF6465c… made its last transaction at 16:10:59 UTC on 26 September and is empty.

Some of the ETH took a shorter path. 0x7cF6465c… paid 10 ETH straight into a Chainflip channel at 20:17:11, which swapped as normal, and 31 ETH into another at 20:22:59. Chainflip returned the 31 ETH to that channel’s refund address at 20:26:23, and the address paid it back in, together with 11.69 ETH from one of the collecting wallets, as swaps of 10 ETH and 32.69 ETH. Those three swaps are among the ten above.

The Vault itself, 0xF5e10380…2Bcc, is Chainflip’s shared pool, so its balance belongs to Chainflip’s liquidity. Chainflip first appears in the trail earlier on 25 September. At 10:58:59 UTC, a listed wallet deposited 9,997 USDT into a Chainflip channel, and at 11:02:11 the Vault paid 9,996.71 USDT back to the same wallet, consistent with a refund. Chainflip uses reusable deposit channels, so naming whoever opened a channel needs its broker records.

The last of the XRP became TRX on TRON

Two XRP routes were observed in the early hours of 28 September. 62,600.61 XRP moved at 02:48 UTC to rhhaamdfa853RgwuzTqTUB3kk4UyY5nrzy, which sold it through THORChain for TRX, TRON’s own coin: 10,000 XRP at 02:57 became 44,145.08 TRX at 03:08, and 52,600 XRP at 03:12 became 232,741.99 TRX at 04:10. Both landed at TBgUx3qCTwZZ5QyxtYzvfZHbe5WnuJcV12, a TRON account created that morning, which held 276,887.07 TRX ($92,471) and had sent nothing at the 04:28 UTC snapshot. The other 20,399.61 XRP ($30,559) went into THORChain at 04:04 UTC for Bitcoin at bc1qzjhsn2nlkxhcfphtfdfmjkwazkmek4575d5xgu. Bitget’s tracker names the TRON account as a swap destination on its in-flight list, and its TRX line reads 1,845 TRX.

Three of the four XRP swaps Bitget listed as in flight at 03:51 UTC had finished by 04:17. 64,134 XRP paid 1.1375 BTC to bc1qxusgput… and 87,230 XRP paid 1.5432 BTC to bc1qchvvjlt…, two collector addresses that sweep every THORChain payout within minutes to legacy addresses on Bitget’s list. The 74,800 XRP swap for ETH on Base was 11,833 of 13,394 pieces through, with 37.14 ETH ($98,550) accrued inside THORChain and the Base address, 0x29717C…, still empty.

The XRP and Bitcoin routes reach connected TRON accounts

The 62,600 XRP swap route paid 92,398 USDT to TRZx3rZr1vqjzTfY8NDpuW4FKwtn4ZJ4ef on 28 September at 04:57 UTC. After the two THORChain payouts described above, TBgUx… sent 276,885.750807 TRX to TN52agbKaebQtAgtvLABhnoxyeVQmPPcbp. That wallet sold the TRX for 92,398.100399 USDT and paid 92,398 USDT to TRZx3r….

The earlier 1.99999430 BTC THORChain route specified TW49e9PGiZoVHgEYKE18hTL2vFePCfeMP8 as its TRON destination. That address received 495,890.099052 TRX, then sent 495,880 TRX to TRGeSQveGZtUV5Vf3bHp4p5rjJ2n22W9wF. Four sales produced 166,063.536932 USDT. At 12:47 UTC on 28 September, 166,000 USDT went to TWzqWeKXnGNztpAkKVDjnr4eNooLQVkz8o.

Those two receiving accounts then transferred 750,000 USDT in total between each other on 29 September:

At 10:12 UTC, TWzq… also paid 525,178 USDT to TSERwt5u2ikDgQZDkhoQbdNmwoVqhLSQrZ, the collector that had received 242,900 USDT from the traced route on 25 September.

The records establish 258,398 USDT of attributable incoming payments and transactional links among the recipients. The 750,000 USDT is gross movement in both directions; the receiving accounts’ wider activity includes other funds. Identifying the operators and matching these deposits to customer records would establish the business relationship. The six addresses along the two direct TRON paths remained outside Bitget’s public address list at 17:21 UTC on 29 September, and still sat outside it at 18:17 UTC on 5 October. The transactions and counterparties supporting these links are set out above.

Binance payouts overlapped the stolen TIA deposits

Bitget’s tracker added TIA, the Celestia network’s token, to its list overnight on 25 to 26 September. 2,608,067.7 TIA (about $1.33 million) left Bitget’s TIA hot wallet for celestia1znch3lcdp59ggrk5zll463ef9qkvxj4c9pnjww at 21:23:01 UTC on 24 September and sat there until the next afternoon.

At 15:58:57 and 15:59:32 UTC on 25 September, two payments of 500 TIA went to celestia1p09mn4zpwy4mhl47clmxx4nd9pw83krmsx0ndv, the second with a numeric memo. Fifty-one seconds after the second, SideShift’s hot wallet paid 0.0903 ETH (about $243) to 0x48857fc6B57ac0c60360568279C8Ac90a5427c8E, consistent with a swap of that 500 TIA. Between 16:05:01 and 16:24:18, the rest, 2,607,067.68 TIA, went in five payments to celestia1fd3mclxp4e2fh0wpau3eg55x2fsm7yjxzg29j2, each with a different numeric memo. Bitget’s tracker labels that address a suspected Binance deposit address; exchanges use such memos to credit a customer account. The address is shared: other senders pay into it with their own memos, and on 25 September it swept its whole balance every eight minutes to celestia1ne4hl0vjs2fr5mmzkaavaqe9kk87ene9azyn5l, the same wallet its sweeps were going to in October 2023. The attacker’s TIA went on in the sweeps at 16:08, 16:16, 16:24 and 16:32 UTC, a pattern that fits an exchange hot wallet.

Between 16:09:47 and 16:27:47, while those deposits were landing, Binance hot wallets paid the same Ethereum wallet, 0x48857fc6…, 257.63 ETH and 545,021.83 USDT, about $1.24 million in total:

The wallet swapped the USDT for 200.17 ETH through MetaMask Swaps within minutes. The timing and receiving wallet support a possible link between the TIA deposits and those Binance payouts. Confirming a sale or swap requires the services’ account and order records. At 02:26:23 UTC on 26 September, 0x48857fc6… sent all 457.896 ETH (about $1.23 million) to a collecting wallet, and that ETH reached one of the eight big holding wallets, whose later movements are followed in the ETH routes.

The stolen ALGO went to exchange deposit addresses

Bitget’s tracker added ALGO, the Algorand network’s token, at the same time. 17,205,521.4 ALGO (about $2.07 million) left Bitget’s ALGO hot wallet for 7EKUW3XG3W2LW37N4AALS54FFXIPPDRD5W47C7UD44S6Z2XNNFMXQA4UJ4 at 21:20:28 UTC on 24 September.

Between 16:41 and 18:31 UTC on 25 September, the wallet sent 7,095,521 ALGO (about $854,397) in seven payments to deposit addresses. Bitget’s tracker labels one of them a StealthEX deposit, three more suspected StealthEX deposits, two KuCoin deposit addresses and one an unidentified exchange. Its notes say StealthEX, an instant swap service, has claimed the 1.1 million ALGO payment at 18:31:35, pending email confirmation. The wallet still held 10,110,000 ALGO (about $1.20 million) at 01:31 UTC on 28 September.

The rest of the ALGO moved on 8 October. The receiver paid out its remaining ALGO in three payments that day: 761,651.38 ALGO ($88,886) at 07:13 UTC, 7,928,712.93 ALGO ($925,297) at 09:58 UTC and the last 1,418,555.98 ALGO ($165,548) at 13:48 UTC. All three reached WJSHMBHS…, the first at 07:17 UTC by way of two more addresses, and Bitget’s tracker lists the relay and both of those addresses as the attacker’s. Between 07:18 and 18:20 UTC WJSHMBHS… passed 10,108,918 ALGO ($1.18 million) on in 40 payments: 5,744,237 ALGO ($670,364) to IXRNOTJQ…, 4,325,681 ALGO ($504,816) to SWLW5DFF…, another listed relay, and the rest in 38 payments of 1,000 or 2,000 ALGO. At 11:00 UTC on 9 October IXRNOTJQ… held 6,333,907 ALGO ($739,180).

The TRON money crossed to Ethereum as USDT

USDT0 became USDD on 29 September

USDT delivered to TRON through the USDT0 bridge was swapped into USDD. By 18:40 UTC on 29 September, seven attacker-labelled TRON wallets held 2,017,538.12 USDD in total. One of those accounts, TLYMrk7fvw…, already held 1,057,690.88 USDD at that check. It received further USDD and held 2,466,039.503332 USDD at the 20:26 UTC chain check. The account had received five USDD payments and made no outgoing USDD transfer at that check, and Bitget counted the balance within its stablecoin holdings. The wallet paid that USDD out on 2 October, after Tether blacklisted it, as described below.

The earlier TRX to USDT0 route

Bitget’s TRON recipient, TBWNguTTgezw9dVorX441C6nDrZpRxYwKD, received 20,593,376.57 TRX (about $6.93 million) on 24 September: a 93 TRX test at 18:31:00 UTC and 20,593,283.57 TRX at 19:16:18. Between 08:25 and 10:49 UTC on 25 September it paid the TRX out in 22 transfers and was left with 0.40 TRX.

One of those recipients, TSqLrg8UNatjcoy2ZBWmf7jsSnxmV8m52N, took 3,270,388.65 TRX from it, converted it to USDT through a UniversalRouter swap contract on TRON and sent 1,102,684 USDT (about $1.10 million) to Ethereum over Tether’s USDT0 bridge in three transfers between 08:43 and 10:33 UTC. LayerZero, the messaging network the bridge runs on, shows all three delivered to 0x9acc843479784924e5ad90b982e4d2a73f95b046, an address on Bitget’s list. That wallet paid the USDT into THORChain for Bitcoin.

Two of those Bitcoin payouts, 2.8097 BTC (about $236,064), were spent in two transactions in a block timestamped 12:23:10 UTC on 25 September. The transactions combine 270 and 335 inputs and use repeated output amounts, a pattern consistent with CoinJoin, which mixes coins from different owners in one transaction to make the onward trail harder to follow. Each THORChain payout carries its Ethereum deposit’s hash in its OUT: memo, so the incoming coins are identified; who owns each output needs further analysis.

Each payout pairs with its deposit: first Ethereum deposit and its Bitcoin payout; second Ethereum deposit and its Bitcoin payout.

THORChain refunded 21,090.49 USDT to 0x9acc8434… at 12:48:47 UTC. Tether froze that address at 14:09:47.

TRON wallets paid addresses Bitget labels as OTC desks

About $851,000 went to six addresses on 4 October

Between 06:29 and 12:04 UTC on 4 October, wallets on Bitget’s attacker list made 14 payments to six addresses its event records label as OTC desks or suspected OTC desks. They paid 309,974 USDT ($309,932) and 541,845 USDD ($541,317), about $851,000 in total at the 4 October prices.

These totals count the payments from Bitget-listed senders. The recipients’ wider transaction histories include other funds. The OTC descriptions are Bitget’s labels for the addresses.

Six desks received about $437,000 on 2 and 3 October

Between 15:00 UTC on 2 October and 13:25 UTC on 3 October, wallets on Bitget’s attacker list paid 366,297 USDT ($366,297), 45,662 USDD ($45,625) and 74,852 TRX ($25,210) to six addresses that Bitget’s tracker labels as OTC desks or suspected OTC desks, about $437,000 in all at the 3 October prices.

After the 29 September conversions, listed wallets swapped USDD back into USDT through the USDD peg module and SunSwap, as in this 2,760 USDD swap at 14:28 UTC on 3 October. Bitget’s event log records these conversions and payments to OTC desks or suspected OTC desks through 3 October.

A listed wallet also parked 1,088,110 USDD in JustLend. TCJTyZs4… received 1,088,110 USDD ($1,087,233) from TLYMrk7fvw… in four payments between 18:05 and 18:10 UTC on 30 September and deposited all of it into JustLend’s USDD lending market at 22:17 UTC on 1 October, taking 108,673,066.14 jUSDD receipt tokens that it still held at 15:30 UTC on 3 October. A second listed wallet, TMhp9r14…, put 23,123 USDT into the same protocol’s USDT market at 09:45 UTC on 2 October and sent the receipt tokens to a swap contract a minute later; Bitget’s tracker books 551,356 USDT at that contract, which it labels an OTC desk, from five listed wallets.

Tether blacklisted two of these wallets, and both held USDD. Tether’s TRON multisig blacklisted TLYMrk7fvw… at 16:47:03 UTC on 2 October and TCJTyZs4… three seconds later; both read as blacklisted at 15:42 UTC on 3 October. The blacklist stops USDT transfers only. TLYMrk7fvw… held USDD, and between 17:35 and 17:51 UTC, starting 48 minutes after the freeze, it paid its remaining 1,519,097 USDD ($1,517,873) to five fresh wallets that Bitget has since listed: 560,000 to TU59enYY…, 250,000 to TXtCwzNm…, 200,000 to TZDUtRXw…, 250,000 to TJUR6ZFS… and 259,097 to TR9GgqtF…. TCJTyZs4…’s USDD was already inside JustLend. Bitget’s frozen total stood at $339,232 at 18:17 UTC on 5 October.

$32,305 crossed to Ethereum and went through Relay into a deposit contract

At 16:30 UTC on 2 October TVfRfq66… sent 32,319.96 USDT to Ethereum over the USDT0 bridge. It arrived as 32,310.27 USDT at listed 0x706916… at 16:32, was swapped on CoW Swap into 32,305.12 USDC at 16:35, passed through 0x9614445f… and 0xe0d7bf0f…, and at 16:48 UTC went through Relay’s router into a vault deposit contract that paid it on to a proxy contract, 0x3B4D794a…. Bitget’s labels tie 0x9614445f… to an account on the Lighter exchange.

A second Chainflip deposit is stuck on Arbitrum

At 14:26 UTC on 28 September listed 0x5fdd7c8e… sent 49.99119 ETH ($133,993) on Arbitrum to 0x1c5d7ee5…, a Chainflip ETH deposit channel on the wrong network. The ETH was still there at 18:17 UTC on 5 October, and Bitget counts it with the 159.98 ETH at 0x35b32736… as $564,781 in flight at its fixed rate, money it expects to stay stranded.

The $1.65 million went through JustLend and a pool opened that morning

At 09:41:09 UTC on 9 October the attacker’s USDD wallet sent its whole 1,651,661.98 USDD ($1.65 million) to TNT1nVbj…, a wallet activated three minutes earlier that Bitget’s tracker lists as the attacker’s. Within the hour the money had passed through JustLend, TRON’s lending market, and into a trading pool built that morning around a new token, JWYT.

Other fresh wallets then took the jUSDT out. From 09:49 UTC, wallets that had been sent JWYT swapped it for jUSDT in the same pair, redeemed the jUSDT at JustLend for USDT and paid the USDT on. TExrkBAx… is one: it took 8,034,268.84 jUSDT out of the pair at 09:49:09, redeemed it for 87,385.01 USDT 27 seconds later and paid the USDT on at 09:50:00. Its gas came from the JWYT creator: TSK8Tu1h… sent 55 TRX ($18) to TEZy9j8n… at 09:32:15, and TEZy9j8n… sent 25 TRX ($8) to TExrkBAx… at 09:47:15, two minutes before it drew the jUSDT out. The pair works as a swap point: the attacker’s 20 wallets put jUSDT in, and other fresh wallets take jUSDT out and turn it back into USDT.

Every step is a TRON transaction, so the route from the attacker’s USDD wallet into the pool is established. The same creator wallet paid the first funds into the wallet that received the attacker’s money and, through one more wallet, the gas of a wallet that took money back out, so one wallet funded both sides of the pool.

The money left the pool through wallets set up before it went in

At 09:23 UTC on 9 October, 18 minutes before the attacker’s USDD reached TNT1nVbj…, TAyqWsTw… activated ten fresh wallets, and from 09:50 UTC those ten collected the USDT redeemed out of the pool. The pool creator’s own withdrawal joined the same chain later, at TXYU5fpK….

Every step is a TRON transaction, so the route out of the pool is established. Inside the pool the attacker’s money mixed with the creator’s liquidity, with money sent round a second time and with 495,446.45 USDD ($495,446) that reached TDdXNhBn… from TZ1UbtDX… at 11:45 UTC, left a minute later and went into the pool through TMeswyi4w… and six more wallets, so from the pool on, every payment carries the attacker’s money mixed with the rest. The ten collectors, TAyqWsTw… and the five wallets that carried the money on were all activated before the attacker’s money first went into the pool, at 09:46:15 UTC.

Two new pools took 8,327,678 USDT on 10 October

The USDT that reached TRON overnight went round the same kind of pool twice more, each time with a new token and a new pair. Between 02:07 and 02:09 UTC on 10 October three of the collector wallets paid TMS87muv… 5,000,903.40 USDD, and at 04:08:57 UTC the fourth, TN7P51Fc…, paid TQkRWdr7… 3,162,982.06 USDD. Each of the two split its sum, each part was swapped back to USDT at the stablecoin’s swap module and spread over fresh wallets, and every one of those wallets lent its USDT to JustLend and moved the jUSDT into a SunSwap V2 pair: the first 67 into TJCAgsPK…, a pair against TSySiUsZ…, and the next 46 into TF3Q4dxX…, a pair against TJrmHgKz…. Both tokens are named JWYT, as the 9 October pool’s token was.

Every step is a TRON transaction, so the route into both pools is established. Bitget’s tracker lists TMS87muv…, TQkRWdr7…, the five wallets that split the USDD and all 113 of the fresh wallets as the attacker’s, and the 113 wallets put 8,327,678.46 USDT ($8.33 million) into the two pairs by 08:00 UTC.

The money left both new pools through wallets created in advance

Both pools were emptied the way the 9 October pool was: wallets sold the JWYT token into the pair for the lending tokens, redeemed them at JustLend and passed the USDT on, and the wallets that carried it had been created before it arrived, the 145 exit wallets about two minutes before the jUSDT reached them and every later hop between 26 minutes and 13 hours before. Pool two, TJCAgsPK…, paid out 505.83 million jUSDT in 69 transfers between 03:35:57 and 05:51:18 UTC, while its 67 deposit wallets were still paying in; pool three, TF3Q4dxX…, paid out 602.38 million jUSDT in 80 transfers between 06:58:45 and 16:25:30 UTC. Pool three also kept filling after the 46 listed wallets: two further splitters, TTT3gTXk… and TSqX6YqJ…, were funded through the swap module from USDD that reached them from two wallets outside the route above, and paid 32 more fresh wallets 58,832 to 95,355 USDT each, every one of which lent its USDT to JustLend and moved the jUSDT into the pair between 08:14 and 16:16 UTC: 2,625,365.29 USDT ($2.63 million) more, so the two pools took 10,953,043.75 USDT ($10.95 million) in all.

Each pool’s liquidity was put up the same way, from USDD gathered minutes earlier. TUvJEEZC… was created at 02:57 UTC, took 501,057 USDD from a wallet that had just collected it from five others, swapped it to USDT at the module at 03:03 and 04:01 UTC, lent it to JustLend for pool two’s jUSDT side, and closed the pool by redeeming 552,236.68 USDT at 05:51:45 UTC; TKVxjTdY… did the same for pool three with 600,000 USDD at 06:29, 07:24 and 08:09 UTC and redeemed 660,846.56 USDT at 16:26:03 UTC. Each paid its redemption to a hub below within 72 seconds.

TFWBUJQN… swapped its USDD back into USDT in six lots between 08:18 and 10:42 UTC and paid each lot within a minute to TKXQpFmD…, one of five wallets created together at 15:05 to 15:07 UTC on 9 October; each lot then passed through three more of them, TAg7hRrV…, TKQjUqKz… and TWHhdN9q…, in under two minutes. TF6XCZvW… swapped 3,052,403 USDT back between 10:44 and 16:11 UTC, sent the first 14,362 of it into the first chain, passed the other 3,038,041 through TRAtFWdD…, TGTZDMPQ…, TUPzU53g… and TLEFfKRi…, four wallets created at 06:56 to 06:57 UTC, and held 3,499,645 USDD ($3.5 million) at 20:30 UTC. The last fresh wallet of each chain paid the USDT that came back, 8,554,368 USDT ($8.55 million), to eight wallets with earlier histories, in lots of 100 to 1,999,900 USDT between 07:46 and 16:14 UTC: three of them took 2,000,000, 2,000,000 and 1,999,900 USDT, the others 12,231 to 900,000. The eight were created between November 2021 and 8 October 2026 and carried 8 to 169 USDT transfers with 6 to 67 other counterparties in the seven days to 20:30 UTC, so from there the pools’ money runs through wallets that handle other people’s money as well; three of them held 265,743, 60,191 and 51,021 USDT ($376,955 together) at 20:30 UTC. Every step from the pairs to those eight wallets is a TRON transaction, so the route is established that far. Bitget’s tracker books the sale into each pair as the point where the money left the attacker; its ledger counted $50.25 million untraced at 20:01 UTC, $15.63 million of it at services.

$205,140 went from TRON to the attacker’s Bitcoin hub on 8 October

On the afternoon of 8 October, 205,139.65 USDT collected on a new TRON wallet crossed to Ethereum, became Bitcoin through THORChain and reached bc1q3vycf72pttcw…, the address that had taken the 11.32 BTC of mixed coins that morning.

Two of the seven payers, which sent 120,180.90 USDT and USDD between them, are on Bitget’s attacker list. Arkham’s labels put three others, which sent 75,815.18 USDT between them, at hot wallets of KuCoin, HitBTC and ChangeHero, so those services’ records can name the accounts behind those payments. Each hop is a signed transaction or THORChain’s own matched record, so the route is established, and Bitget’s tracker lists every wallet on it, from TF6ma5YU… to the hub, as the attacker’s.

The BNB went to Bitcoin through THORChain

The main BNB holding was 5,896.58 BNB (about $4.56 million). Between 05:36 and 08:12 UTC on 25 September, 29 successful THORChain deposits, starting with 416.023 BNB, asked for Bitcoin at 11 addresses. Their gross total, 8,496.96 BNB, is higher than the holding because refunded BNB was deposited again. The 27 BNB Chain addresses on Bitget’s list held 10.14 BNB at 15:24 UTC on 26 September.

By 08:53 UTC on 25 September, 48.74418538 BTC (about $4.10 million) had arrived in Bitcoin payouts whose OUT: memos name deposits in our trace, a figure that also covers an earlier ETH conversion. The matched receipt list counts each Bitcoin transaction once. One of those BNB swaps and a 28.24 ETH swap at 04:18 UTC both named the Bitcoin address 13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T, which ties the two routes together. Another, bc1qdphrvtvt43nlc26vd4srumdu5u50x6xhx23qu5, was named in three BNB swaps and has since collected onward Bitcoin transfers.

Bitcoin parcels and the coinjoin rounds

Four Bitcoin wallets gathered 36.91 BTC

Between 18:44 and 20:20 UTC on 29 September, transfers from addresses on Bitget’s attacker list gathered 36.91262651 BTC into four Bitcoin wallets. Three of those wallets emptied on 30 September, while the fourth still held 0.99999556 BTC at our midday check.

Every output recipient in those four spends appears on Bitget’s attacker address list. Some spends combine coins from different wallets, so the output totals include more than the individual wallet’s contribution. The table follows the original balances as they move onward.

Three new coinjoins took 0.808 BTC

Three confirmed coinjoins on 29 September each took one input from a Bitget-listed attacker address. Their combined input was 0.80795458 BTC. The two later rounds were still pending at an earlier 20:25 check and had confirmed by the 21:40 follow-up.

At 21:40 UTC on 29 September the checked sample contained 18 confirmed rounds outside Bitget’s coinjoin inventory, receiving 20.49517717 BTC in listed inputs. Some coins entered more than one round, so this is a gross movement count, not an additional Bitcoin balance. A follow-up of the round outputs found no exact attacker exit from these three by 21:40 UTC.

Fifteen more rounds received 19.69 BTC in listed inputs

A comparison of 30 coinjoin rounds through 14:18 UTC on 29 September identified 15 transactions absent from Bitget’s coinjoin inventory at the 17:21 UTC check. Inputs from Bitget-labelled attacker addresses in those omitted rounds totalled 19.68722259 BTC, about $1.64m. Ten rounds were on 25 to 26 September; five later rounds received 1.72974061 BTC on 29 September. The comparison covers this dated sample.

The amounts count the listed attacker inputs, rather than every participant’s coins. They measure gross activity through mixing rounds: some rounds already have traced exits, and coins can be remixed. They therefore remain separate from current holdings and the tracker’s untraced ledger balance.

Transaction evidence for the fifteen rounds

UTC	Coinjoin transaction	Inputs from Bitget-listed attacker addresses
25 September 12:23	2427e6bb44…	0.56485361 BTC
25 September 12:23	eb9029ca5d…	1.31804246 BTC
25 September 12:23	7c7bc23aca…	2.24486521 BTC
25 September 13:11	ff12eebcc0…	0.05835371 BTC
25 September 23:29	e8b3a39843…	1.86864545 BTC
26 September 01:17	d6895ff251…	2.01023251 BTC
26 September 02:18	424b0e946a…	2.03442221 BTC
26 September 19:23	867cbb29ef…	6.24441232 BTC
26 September 19:37	b234c5211c…	1.07229730 BTC
26 September 20:20	c9caad0afb…	0.54135720 BTC
29 September 09:45	6c81069ece…	0.32052275 BTC
29 September 10:22	9b1b3bb443…	0.39028534 BTC
29 September 11:02	6cfb7dffd0…	0.35321909 BTC
29 September 12:37	c8bd4a0da6…	0.34524981 BTC
29 September 14:18	7f0d64bd3d…	0.32046362 BTC

The earlier parcels and coinjoin counts

The attacker held 2,095.71 BTC ($177.24 million) on Bitget’s tracker at 22:30 UTC on 27 September, the last count before the overnight moves above took it past 2,130 BTC. Nearly all of it sits in parcels, each one receipt at a single address: at 00:43 UTC the seven largest, from 42.06 BTC down to 13.23 BTC, each still held their one unspent receipt. New parcels kept arriving, including 14.0 BTC ($1.18 million) at 23:35:40 UTC on 26 September. At 00:23:36 UTC on 27 September, the THORChain payout address bc1qhkhsxr57czw5cayhvz0p2wgf2zs29d5hwcsdw6 swept 17.228 BTC ($1.45 million) from 244 inputs into one new address. Bitget’s tracker counted $49,929 of the stolen funds paid into exchanges at 14:28 UTC.

Between 19:23 and 20:20 UTC on 26 September, bc1q32r87vv3vlzjrm6gk7xedswvzxm97vqmhtq8lm put all 7.85806682 BTC ($662,779) it had received, eleven THORChain payouts and a little change, into three coinjoins:

Their outputs use the standard denominations of WabiSabi, the coinjoin protocol of Wasabi Wallet 2.0 and Ginger: 0.67108864 BTC is 2 to the power 26 satoshis and 0.43046721 BTC is 3 to the power 16. Bitget’s tracker names the coordinator as Kruw. With 7.44 BTC that went into coinjoins on 25 September, including the two spends described above, and three more coinjoins on 27 September carrying 1.92, 2.02 and 10.0 BTC, 29.23 BTC ($2.47 million) of the attacker’s Bitcoin had been through nine coinjoins by 27 September, about 1.4 per cent of the total, and the outputs of the three newest went into further rounds of mixing. Overnight the THORChain payout address bc1qd9snypuds4vj8jslmwg7qw86xta6xz85jc35k8 fed four more rounds within hours of each payout: 1.58 BTC at 23:24 UTC on 27 September, 1.77 BTC at 00:48 on 28 September, 1.82 BTC across three inputs into a 307-input coinjoin at 02:42 and 0.88 BTC into a 200-input coinjoin at 03:49, all in WabiSabi denominations, taking the total to 35.28 BTC ($2.94 million) through thirteen coinjoins. The section after next follows the morning’s two rounds back out.

Later spends link outputs from eight coinjoins

A coinjoin combines inputs from multiple participants and uses repeated output denominations. Across six rounds on 25 and 26 September, candidate onward routes account for 10.67 BTC (about $900,000) of the 15.29 BTC attributed to the attacker at entry. Later joint spends and payments to listed addresses support the reconstruction; the round arithmetic on its own identifies no owner.

The clearest case is the coinjoin at 19:37:40 UTC on 26 September. bc1q32r87vv3…, an address on Bitget’s list, put in 1.07229730 BTC ($90,442). Three of the 250 outputs, 0.67108864 + 0.33554432 + 0.06566248 BTC, total 1.07229544 BTC: 186 satoshis below the input. Sixteen minutes later, those three outputs were spent together, with nothing else, into bc1qnrhu8fc9yxnyy93wcs7a4e4htchan5j0e2rvwa, which held 1.07217169 BTC ($90,431 at the 27 September price) and was still unspent at 21:30 UTC on 5 October. On 27 September it was the one address from the five traced mixes outside Bitget’s attacker list; Bitget listed it by 30 September as a post-mix merge recovery address.

The 1.07 BTC at bc1qnrhu8fc… still sat where it was merged at 21:30 UTC on 5 October. The other traced coins have moved on since: the 7.18 BTC output was spent in the same block, the 7.74 BTC output the same afternoon, and the 0.54 BTC at bc1qtyh7eu… into a 2.14 BTC parcel at 20:49 UTC on 26 September.

The sixth, coinjoin 46186ae8… on 25 September, took 4.6258 BTC ($392,009) from three inputs, 4.03 BTC of it from two addresses on Bitget’s list, and its outputs went through further rounds of mixing. Three transactions on 26 September gathered remixed outputs back into single addresses:

The two listed collectors passed the Bitcoin on: the 2.01 BTC to bc1q6h85fspx5l475axcpzs7hr0x60qvptq5sy52mw, where it was still unspent at 21:30 UTC on 5 October, and the 0.87 BTC, 20 minutes after it arrived, together with a THORChain payout into bc1qtzwpk7k2r5029u2867n43a3t6wz28a4757g8uh, which held 1.88 BTC ($159,319), also still unspent at that read. The three gatherings total 4.88 BTC, 0.26 BTC more than the coinjoin’s input, so additional funds contributed to those consolidations; the difference alone establishes no owner for those funds.

The 2.00 BTC at bc1qqysfnpv…, which is likely the attacker’s, went into THORChain at 10:39 UTC on 26 September asking for USDT on TRON, and the swap paid 168,175.86 USDT ($168,176) at 12:27 UTC. At 12:49 UTC the USDT moved on to TJvUHtZve1DoCyjTSx9ia4yQwD1TaMDr98, an account that has taken lots of 50,000 to 70,000 USDT since June and pays them out within hours. It paid this USDT out in 13 transfers by 14:22 UTC, the pattern of an over-the-counter cash-out desk.

Two further output groups connect to listed wallets

Two further reconstructions identify 1.37638849 BTC of outputs from 25 September coinjoins. In each case, the proposed outputs fit the listed input after the round’s fees and were later spent together alongside other listed attacker inputs:

The resulting consolidation wallets were already on Bitget’s attacker list. These observations strengthen the reconstruction of the earlier routes. Matching denominations alone permits several possible output combinations, so the later joint spends and listed-input links supply the additional evidence.

Later spends link two morning coinjoin rounds

For the two rounds of 28 September, the round arithmetic and later spends support candidate links to three fresh addresses. The proposed reconstruction assigns 2.70019177 BTC at entry and 2.70006206 BTC to the later outputs, a difference of 12,971 satoshis across the route. Common control remains an inference. Dollar figures in this section use Chainlink’s BTC/USD of $83,098.11, read at 06:35 UTC.

The third input to the 02:42 round is what ties the morning together. 0.06874157 BTC is the change of a consolidation at 01:42 UTC that gathered eight mixed outputs, three of them from the 00:48 round and one from the 23:24 round, including the very output Bitget’s tracker attributes to the attacker in the 00:48 round, and paid 5.14756520 BTC ($427,753) to bc1q4gw6wztf7zqqk93p8qs84r48r9f20cvl3p22zx. Including that change input makes the proposed amount reconstruction balance. This is a hypothesis about ownership, supported by the subsequent payment below. At 05:11 UTC that address split the coins: 2.00000000 BTC ($166,196) to bc1q8lnejqdgfqr9zs7435kg8794p8vtamy68yal7r, which Bitget’s own map labels as the attacker’s at hop 5 and which has collected the attacker’s THORChain payouts since 26 September, and 3.14752995 BTC ($261,554) to a new address, bc1q9fyswsnrc7gm686zfk4q3r2szy45eww8x45r2t, unspent at 06:35 UTC. Nine minutes later bc1q8lnejq… sent the 2 BTC into THORChain as a streaming swap into TRX for the TRON address TW49e9PGiZoVHgEYKE18hTL2vFePCfeMP8, and at 06:35 UTC THORChain’s public record showed 1.646 BTC swapped and about 496,000 TRX ($165,546) due. That payment to a previously listed collector strengthens the attribution of the consolidation and proposed change route. Bitget’s own page for bc1q8lnejq… logs the 2 BTC as a “Transfer between attacker addresses” from an “Unknown address”, and the consolidation, its change address and the two 02:42 exits were absent from its attacker list, as they still were at 18:17 UTC on 5 October. With the three addresses above, 5.84759201 BTC ($485,924) of freshly mixed Bitcoin rested at 06:35 UTC in four addresses outside Bitget’s list; all four went back into coinjoins at 07:21 and 08:46, as described below.

Bitget’s tracker logs each attacker-fed round as the attacker moving the round’s whole output to its first output address, noted as a move to a new address: 10.01544197 BTC to bc1ppkwye3… for the 03:49 round and 17.51268314 BTC to bc1qp554yc… for the 02:42 round. That guess landed in the 00:48 round, whose first output the consolidation above gathered in. In the 03:49 round the first output was remixed at 04:22 UTC in a 269-input round, after the attacker’s own three outputs had been swept, and it falls outside our candidate reconstruction; in the 02:42 round the first output was remixed at 05:41, and the proposed reconstruction excludes it.

A third round at 07:21 UTC took 1.19289137 BTC from the three inputs being followed: 0.31614728 and 0.01817093 BTC from two addresses on Bitget’s list, and the 0.85857316 BTC exit of the 02:42 round, alongside those listed inputs. Coinjoin co-participation alone provides no additional evidence of common ownership. By 13:55 UTC 161 of the round’s 322 outputs had been spent, most of them into later rounds, so its attacker outputs are still being followed.

At 08:46 UTC the three exits above went back into a coinjoin together: bc1q9fyswsn… (3.14752995 BTC), bc1qc305vx… (0.96443474) and bc1qspdksc… (0.87705416), 4.98901885 BTC in all, were inputs to a 113-input, 134-output round alongside 1.57 BTC of the 07:21 round’s outputs. The observed route continues into further coinjoins: 68 of the round’s 134 outputs had gone into further rounds at 09:27, 10:16 and 11:36 by 13:55 UTC. At the 13:55 UTC check on 28 September, the 4.99 BTC had entered further mixing transactions. The attacker’s share of their outputs remained unattributed.

Four more coinjoins and a 1.92 BTC return

Four coinjoins between 15:05 and 18:40 UTC on 28 September took 14.64451119 BTC from addresses on Bitget’s attacker list. Each transaction mixed those inputs with coins from other participants, so the figures below count only the listed inputs:

An earlier remix trail also reached an attacker-labelled wallet. At 05:46 UTC on 28 September, one transaction gathered 45 outputs from 12 coinjoin rounds into a single 1.91693141 BTC output. Eleven of those inputs came from the 23:24 and 00:48 rounds already linked to the attacker in the section above. At 06:11, its sole output moved in one hop to bc1q5ccqu68…, an address on Bitget’s attacker list, as 1.91693042 BTC.

The payment shows the 1.91693 BTC consolidation output reaching an address Bitget attributes to the attacker. Shared coinjoin rounds do not establish which of the 45 individual inputs had previously belonged to the attacker. From the listed address, 0.1 BTC went into THORChain at 06:51 with a memo requesting USDT on TRON for TE8UqWsaKPUkwSndzLi8TPQNuZ8iwuTcUn; THORChain refunded 0.09998432 BTC at 10:20. The 1.81692022 BTC change went at 08:46 to another address on Bitget’s list. The 1.92 BTC consolidation and the later 14.64 BTC of coinjoin inputs are different observations, rather than figures to add together.

At the 03:15 UTC check on 29 September, a follow-up of 12 open coinjoin rounds and their later spends found the same 1.91693 BTC consolidation, with no further gathering payment attributable to an attacker wallet. The four 28 September rounds above still led into later mixing rounds. Six wallets holding 21.09363244 BTC from earlier, separately traced de-mixes remained unspent and were already on Bitget’s list. This check narrows the observed exits at that time; later spends can change the picture.

A later exact-amount check identified three further post-coinjoin gathering spends. The 03:49 round on 28 September sent 0.87710136 BTC into one gathering transaction; its output later entered another coinjoin, whose exit remained open at that check. The 0.05835371 BTC input from 25 September was matched to a 0.05834999 BTC group that later moved with coins from Bitget-listed addresses into another listed wallet. A 1.31804246 BTC input matched 1.3180385 BTC in a consolidation already counted through the earlier 2427e6bb round. These observations add route detail, not three new wallet balances. Across the 33 rounds examined at 21:40 UTC, 25 had no single exact gathering spend attributable to the attacker’s input.

Two more coinjoins took 0.71 BTC on 2 October

Two THORChain payouts to a wallet on Bitget’s attacker list went straight into coinjoins on 2 October, 0.71354782 BTC ($60,509) together:

Both are WabiSabi rounds of the kind described above, mixing the two coins with hundreds of other participants’ inputs. Bitget’s tracker added both rounds to its coinjoin line, and its Bitcoin count fell by the same 0.71 BTC, to 4,017.41 BTC.

Three coinjoin outputs reached listed wallets on 29 September

Three outputs of a WabiSabi coinjoin on 29 September, 0.03805084 BTC ($3,255), were gathered and then spent with coins from Bitget-listed wallets about an hour later:

1. 06:37 UTC. Coinjoin 08f90413… had 296 inputs and 348 outputs. Three of its outputs held 0.03805084 BTC between them.
2. 07:42 UTC. Those three outputs were gathered into bc1qw6kqw64…: 0.03804869 BTC after a 215-satoshi fee.
3. The same block. One transaction spent that coin together with eight coins from wallets Bitget lists as the attacker’s: four from bc1qgwy254w…, three from bc1q0clx43c… and one from bc1qzr46zdq…. The joint spend links the gathered coin to inputs from Bitget-listed wallets and pays a listed destination. It supports common control; a collaborative transaction can also combine inputs signed by different participants.
4. The result is one output of 22.81490177 BTC ($1,951,739) at bc1q65huxc7…, a wallet Bitget lists, unspent at 15:49 UTC on 2 October and still unspent at 21:30 UTC on 5 October. All but 0.038 BTC of it came from the eight listed coins.

The later joint spend supports attribution of these three outputs. The original round mixed 296 inputs, including 279 from earlier mixing transactions. This exit evidence is kept separate from attribution of the original inputs.

One 33-input spend un-mixed the Zcash-swap group’s coinjoins

At 07:50:16 UTC on 5 October, one transaction spent 33 inputs into a single output of 8.89237569 BTC ($758,655). Five of the inputs are the Zcash-swap group’s own coins from 1 October, 4.9354 BTC: four swap payouts and a change output from the addresses listed on 4 October. Twenty-three are outputs of six WabiSabi coinjoin rounds mined between 04:05 and 07:03 UTC that morning, most of them in the rounds’ standard denominations, 3.0018 BTC ($256,096) in all. The other five are outputs of the same wallet’s earlier consolidations, splits and a peel. A transaction with one output and no repeated denominations is a plain spend, so one signer controlled every input. That establishes the 23 mixed outputs as the group’s coins, within four hours of the rounds that mixed them.

Three of the group’s coins had entered rounds earlier that morning: 0.979 BTC ($83,529) at 03:38, 1.060 BTC ($90,444) at 04:05 and 0.930 BTC ($79,307) at 06:00. The ten addresses that moved are bc1qes9y2gd…, bc1qrsvze3h…, bc1qtsukkqk…, bc1qmhg7pwq…, bc1pxz3r5p4…, bc1p43u0ga0…, bc1qxyf4jcj…, bc1qef6pgt9…, bc1qzwmu3kx… and bc1qttq5j62…; bc1q0etfvdrm… (21.74 BTC) and bc1pv200hzp… (6.78 BTC) stayed put. A fourth coin, 6.5 BTC ($554,549), was merged at 06:00 and moved to a fresh address at 06:30. In the 04:05 round the group’s 1.06011367 BTC input matches exactly one 1.0 BTC output plus a 0.06011205 BTC change output and 162 satoshis of fee, and that change output was spent in the 33-input transaction. The 1.0 BTC output’s ownership is supported by that arithmetic; its next spend would establish it. The hoard’s 0.2 BTC parcel of 4 October entered a 209-input round at 22:35 UTC that day, and its outputs cannot be matched to the input by amount.

At 18:13 UTC on 5 October, the group’s coins stood at 43.91 BTC ($3.75 million) across four addresses established as one wallet by spends: 21.74086444 BTC and 6.778085 BTC untouched since 30 September and 1 October, 8.89237569 BTC in the consolidation and 6.49999356 BTC at the fresh address. A further 9.68 BTC ($825,851) is supported: the 1.0 BTC mixed output above, and 8.68 BTC ($740,536) at an address funded on 30 September by a wallet, bc1pkee0lv6…, that received a 0.02978 BTC peel from the group at 04:52 UTC and spent it in the same block, together with its own change, as a 0.0375 BTC payment to a deposit address that takes payments from several senders. Sending a wallet exactly the shortfall on a bill it is about to pay is how an operator treats a wallet of its own; a payment to a third party is the alternative, and it is recorded. The group’s attribution to the theft remains supported, as described in the Zcash section.

At 13:30 UTC on 6 October every one of those coins stood where it was: 43.91 BTC ($3.78 million) established and 9.68 BTC ($833,513) supported. Two smaller coins of the group resolved that day. The 0.001 and 0.1 BTC halves of two splits whose other halves fed the 33-input spend went at 06:02 and at 06:39 UTC on 5 October into LI.FI’s Bitcoin intake, and LI.FI’s own status record shows 0.0999955 BTC ($8,610) becoming 8,576.42 USDT ($8,576) on Ethereum at 0x595d53a2…, which took a further 21,246.56 USDT from another wallet and at 09:09 UTC on 5 October sent its whole 29,908 USDT ($29,905) into a deposit-forwarder contract that moved it to an exchange-style collector two minutes later: a test, then a send, into what reads as an exchange deposit. The attribution labels read on 6 October carry the collector as Mixin Network’s hot wallet and the forwarder as a Mixin deposit address. LI.FI’s record and the chain establish the route; the halves as the group’s are supported. A second gathering line is recorded as possible: bc1qg9aw2psdht… holds 16.15 BTC ($1.39 million), consolidated at 09:33 UTC on 6 October in the block that carried Maya’s refund to the attacker, from outputs of all three rounds the group’s coins entered and of the hoard’s round, mined in the same blocks as the attacker’s transactions and splitting in the hoard’s 5-and-6 style. Mixed outputs carry no owner and hundreds of people were in those rounds, so it stays possible; a 0.90 BTC side output of the line joined a consolidation that paid 2.03 BTC ($174,797) to a FixedFloat hot wallet on 5 October, which gives it a counterparty that could name it.

Mixed coins matching 11.32 BTC were paid to a listed wallet on 8 October

At 02:52:03 UTC on 8 October (block 970,427), two addresses on Bitget’s attacker list entered WabiSabi coinjoin rounds mined in the same block. bc1qv77tvx7… put 9.1869967 BTC ($756,281) into a round of 190 inputs and 225 outputs. Those coins came from 296.56 ETH ($747,686) that the listed wallet 0x132e00d5… sent to THORChain at 02:43 UTC on 7 October (140 ETH and 156.56 ETH), paid out as 9.18721587 BTC to the listed exit receiver bc1qh2mlug08… at 03:13 UTC (1, 2), moved on to bc1q87turpmv… at 16:49 UTC and from there to bc1qv77tvx7… at 01:35 UTC on 8 October. bc1qyzpndgqm… put 2.1361822 BTC ($175,852) into a round of 261 inputs and 291 outputs. Between 03:55 and 06:02 UTC six later rounds each took outputs of both.

At 07:01:53 UTC (block 970,452), one transaction gathered 40 outputs of those six rounds, 11.32310975 BTC, into a fresh address, bc1qen0msmzs33tc…. The two wallets had put 11.3231789 BTC ($932,133) into the first rounds, so the gathered coins come within 6,915 satoshis ($5.69) of it. The fresh address paid 1.0 BTC to bc1q3vycf72pttcw… at 07:03 UTC and kept the change, moved the rest to a second fresh address at 08:16 UTC, and that address paid 10.322 BTC to bc1q3vycf72pttcw… at 09:50 UTC. Bitget has listed bc1q3vycf72pttcw… as an attacker downstream address since 5 October; it held 19.122 BTC ($1.57 million) at 13:10 UTC.

From the gathering onwards every step is a spent output, so that route is established. A coinjoin round hides which output belongs to which input. The gathered coins match the 11.32 BTC that went in to 6,915 satoshis across two mixing stages, and they went to an address Bitget lists as the attacker’s, which took the 1.0 BTC test four hours after the first rounds and the rest seven hours after: the link through the rounds is supported.

The hoard split into four listed parcels on 5 October

Between 06:30 and 07:50 UTC on 5 October, the Bitcoin hoard that Bitget labels as the attacker’s collection address, bc1qeqp6390m…, paid out its balance in four parcels: 5.0 BTC ($426,576) at 06:30, 5.0 BTC at 07:03, 10.0 BTC ($853,152) at 07:21 and 9.53213016 BTC ($813,235) at 07:50, the last of them including a 0.12 BTC return from a Chainflip receiver at 06:49, 29.53 BTC ($2.52 million) in all. Bitget’s tracker listed all four parcel addresses as attacker downstream within the hour, and all four were unspent at 18:13 UTC, and still at 13:30 UTC on 6 October (29.53 BTC, $2.54 million at that day’s price). The hoard’s 0.2 BTC parcel of 4 October went into a coinjoin nine hours after it was cut, so the mixing step is the thing to watch for these four.

The 07:50 parcel and the Zcash-swap group’s 33-input consolidation were mined in the same block, 969,979, and thirteen outputs of the round the hoard’s 0.2 BTC parcel entered were reused as inputs in the seven rounds the group’s coins passed through that morning. Shared timing and one coordinator are shared with every other participant in those rounds, so on their own they carry limited weight; the stronger ground is the group’s habit of gathering Chainflip payouts together with swap payouts, described below, on a wallet Bitget describes as built from Chainflip payouts. A spent output joining the two sets would establish the link; until then it remains supported.

161.83 BTC on 19 listed addresses was split into 50 coins on 8 October

At 08:38:08 UTC on 8 October, twelve transactions in one block, 970,466, spent the coins of 19 addresses on Bitget’s attacker list, 161.8331718 BTC ($13.32 million), each paying exactly 10.0 BTC to a fresh address with the rest as change. Between 09:26 and 10:39 UTC, chains of payments split the twelve 10 BTC coins into 37 round amounts on fresh Taproot addresses: 17 of 4.0 BTC, eight of 2.0, three of 3.5, two each of 2.2, 4.1 and 1.8, and one each of 1.0, 2.5 and 3.8, 117.99984322 BTC ($9.71 million) in all. Another 43.826662 BTC ($3.61 million) sat in 13 more coins. Bitget listed the new addresses as attacker downstream within the hour.

At 12:42:02 UTC (block 970,491) one 2.0 BTC ($164,642) coin entered a WabiSabi coinjoin round of 225 inputs and 247 outputs, and in the same block a 2.2 BTC Taproot coin was split into 1.0 and 1.2 BTC. In block 970,493 a 1.8 BTC coin was split into 1.0 and 0.8 BTC. At 13:10 UTC the other 47 coins, 155.83 BTC ($12.83 million), were where the split left them. Every step is a spent output: established.

Five of seven 3.87 BTC coinjoin outputs trace back to the attacker’s coins

By 05:03 UTC on 9 October, coins from the 8 October split, 118.00 BTC ($9.74 million) in all, had gone into 15 WabiSabi coinjoin rounds, and in one of those rounds arithmetic shows at least five outputs are the attacker’s. Every entry below is a spent output from an address on Bitget’s attacker list.

The 16:00:22 round in the fifth row (block 970,510) took ten of the split coins, 33.19994288 BTC ($2.74 million), alongside 96 other inputs that came to 10.77085371 BTC ($888,697), and it paid seven outputs of exactly 3.87420489 BTC ($319,659 each). A participant in a coinjoin can only take outputs its own inputs pay for. Two of those outputs come to 7.75 BTC, which the other 96 inputs could cover; three come to 11.62 BTC, more than all of them put together. So at least five of the seven, 19.37 BTC ($1.60 million), belong to the wallet that put in the ten split coins, on the normal reading that participants keep their value to themselves.

Four of the seven outputs re-entered rounds that evening alongside more coins from Bitget-listed addresses: two went into the 20:02:47 round in the seventh row with listed coins of 4.0 and 3.5 BTC, one into the round beside it with nine listed coins, and one into the 22:05:48 round with a listed 2.0 BTC coin. A wallet registers its coins in a round together, so that grouping points to one owner. With the arithmetic it makes the attribution supported, the strongest grade a link through a coinjoin can carry. By 03:56 UTC on 9 October six of the seven had gone into further rounds; the seventh, bc1prqc3uav3…, still held its 3.87420489 BTC at 11:00 UTC.

The seventh 3.87 BTC coin went into a 228-input round, and 3.23 BTC of that round was gathered into listed addresses

The seventh output, bc1prqc3uav3…, held its 3.87420489 BTC ($320,568) until 17:46:08 UTC on 9 October, when it went into round bc4a728a… with 227 other inputs, 30.73 BTC ($2.54 million) in all, paid out as 341 outputs in the usual denominations, from five of 2.58280326 BTC ($213,712 each) down to 0.0001 BTC ($8). A coinjoin hides which outputs an input paid for, so the coin’s share is read from where the round’s outputs went.

The gatherings came in waves: two outputs at 18:10:46 UTC into bc1qtrezusj…, one at 20:09:23 into bc1qvtz3fky…, 26 at 20:14:21 into all four addresses, one each at 23:14:51 and 00:02:53, and the last two at 00:41:50 and 00:59:32 into the refund address. The four addresses sent everything they gathered through THORChain overnight (below), so this round’s gathered share is already USDT on TRON. The coin’s own link to that share runs through a single round with 227 other inputs and rests on the output flows alone, so it is possible; the five of the seven 3.87 BTC outputs that the arithmetic ties to the ten split coins stay supported.

Bitcoin gathered from the coinjoin rounds became $1.65 million on TRON on 9 October

Between 04:47 and 07:56 UTC on 9 October, ten swaps through THORChain turned 20.2379915 BTC ($1.67 million) into 1,651,661.98 USDT on TRON, and nine of them, 19.57 BTC ($1.61 million), trace back to coins gathered out of the coinjoin rounds that took the split coins, eight of them directly.

The gathering. From 01:40 UTC, transactions of 3 to 41 inputs gathered outputs of the rounds in the table above, and of the rounds those outputs went on to. Every input of every gathering was a coinjoin output. Twelve of them paid two addresses: bc1q6m0ddwh… took 0.44999482 BTC ($37,129) at 01:40 UTC, which it passed straight on, and 10.35511077 BTC ($854,395) in five more gatherings between 05:23 and 05:54 UTC, the first at 05:23:47, and bc1qjnum3px… took 10.55188947 BTC ($870,631) in six between 05:54 and 07:56 UTC, the largest of them 37 inputs. Bitget’s tracker lists both addresses as the attacker’s. A coinjoin hides which output belongs to whom, so the link from the rounds to these addresses is supported; from the gatherings on, every step is a spent output or THORChain’s own record, and that route is established.

The swaps. The gathered coins were split, passed through one to four more addresses and paid into THORChain with memos naming a TRON address for USDT. Each THORChain payout on TRON carries the transaction ID of the Bitcoin deposit it answers, so every row below is one matched swap.

The two smaller deposits, 1.12 BTC ($92,486), reached THORChain through chains of single-input hops. The 04:47 one began as the 0.45 BTC gathered at 01:40 UTC and, after 14 single-input hops from 01:59 UTC, passed through bc1qhl3gwfgy…, the address that received the Bitcoin of the 1 ZEC swap of 30 September.

One Chainflip account sits behind both ends. Bitget’s tracker labels bc1q6m0ddwh…, the first gathering address, as the Bitcoin refund address registered by Chainflip liquidity account 1689, and Chainflip’s own record for that account, cFNYA3Mks…, lists it as the account’s Bitcoin refund address on the morning of 9 October, until the account registered a new one at 14:27 UTC. Bitget gives bc1qhl3gwfgy… the same label, and the same account’s TRON refund address, TPG4TCSX…, carried the 36,391.52 USDT of the 04:57 payout on to the attacker’s TRON wallets. Only the account holder can register a refund address, so the address that took the 30 September Zcash swap’s Bitcoin and the address that gathered the mixed coins on 9 October were both named by one Chainflip account.

Into USDD. Each TRON address passed its USDT on within 14 minutes, most of it to two wallets, TMjJMjTc… and THzMwjay…, which swapped the USDT one for one into USDD at TRON’s USDD peg module. By 09:22 UTC all 1,651,661.98 USDD sat in TDdXNhBn…, which Bitget’s tracker also lists as the attacker’s. What it did next is below. One more line of gathered coins went the other way: at 09:40 UTC, 7.38847149 BTC ($609,619) gathered through bc1qjnum3px… went back into a new 174-input round.

Chainflip account 1689 gathered 2.97 BTC more that afternoon

Between 14:38 and 15:00 UTC on 9 October, three transactions gathered 35 more outputs of the coinjoin rounds the split coins and their outputs went through, 2.9675032 BTC ($245,814), straight into bc1qs0hnjh3e…. Chainflip’s record for liquidity account 1689, cFNYA3Mks…, shows the account registering that address as its Bitcoin refund address at 14:27:24 UTC, in Chainflip block 15,173,740, in place of bc1q6m0ddwh…, and opening a new Bitcoin deposit channel, bc1pdryejptq…, 30 seconds later in block 15,173,745. Bitget’s tracker labels the refund address as the account’s and the channel as a Chainflip deposit channel.

Every input of the three gatherings is an output of a round that took split coins or of a round those outputs went on to, among them the 22:54:14 and 01:27:31 rounds in the table above. A coinjoin hides who owns each output, so that the gathered coins are the attacker’s is supported. From the gatherings on, every step is a spent output or a payment back from Chainflip’s channel, so that route is established, and the refund address passed each gathered coin into the deposit channel within the block it arrived in.

Four gathering addresses sent 85.59 BTC through THORChain overnight, and the USDT crossed to TRON

Between 15:03 UTC on 9 October and 01:01 UTC on 10 October, 67 gathering transactions pulled 85.59 BTC ($7.08 million) of coinjoin outputs into four fresh addresses, each of which Bitget’s tracker dates to its first gathering: bc1qrdtunr0… (21.60 BTC, $1.79 million, over 17 gatherings from 15:03 UTC), bc1qvtz3fky… (20.57 BTC, $1.70 million, over 20 from 17:14 UTC), bc1qfyx9upd… (23.28 BTC, $1.93 million, over 12 from 17:21 UTC) and bc1qtrezusj… (20.14 BTC, $1.67 million, over 18 from 17:43 UTC). Two of them sent 1.56 BTC ($128,919) into Chainflip deposit channels first and had it back within 6 and 24 minutes; everything then went into THORChain, in deposits of 0.96 to 3.29 BTC ($79,000 to $272,000), each with a swap memo naming one wallet, and every Ethereum wallet named sent what it received, less 1,200 USDT one of them swapped for gas, into the USDT0 bridge within 40 minutes. Chainflip account 1689’s refund address, which had spent the afternoon sending 2.97 BTC ($245,750) into a Chainflip channel and getting it back, joined the same route from 23:41 UTC.

0x98666580… swapped 1,200 USDT for ether to pay its gas. Every THORChain payout names the deposit that paid for it in the memo of the paying transaction, so each row is read from the chain at both ends. On TRON the USDT0 contract delivered 7,432,497.40 USDT to four collector wallets Bitget lists as hop 20: TWK85jF5… (1,709,661.16), TSzBtege… (1,458,834.38, plus the 208,425.83 USDT paid on by TP7gsCw6…), TDkXeHBL… (1,623,982.03) and TN7P51Fc… (2,640,019.83, plus the 522,962.23 USDD that TANvASa8… paid it at 02:36:21 UTC from the refund address’s five TRON swaps). From the gatherings to the collectors every step is a spent output, a THORChain payout or a bridge delivery, so the route is established; that the gathered coins are the attacker’s rests on the rounds they came from, as it does for the refund address above, and is supported. The two pools carry the money from the collectors on.

USDT that crossed back to Ethereum became 14.44 BTC through THORChain on 9 October

On the evening of 9 October the attacker ran THORChain in the other direction. Between 18:02 and 19:38 UTC, thirteen fresh Ethereum wallets that Bitget lists as the attacker’s receipts from TRON each took 49,527 to 99,970 USDT from the USDT0 bridge, 1,199,182 USDT ($1.2 million) in all, and sold it for DAI on CoW Swap within three minutes of receiving it. Twelve of them passed their DAI to the thirteenth, 0xf9f00af3…, which had 1,198,199 DAI ($1.2 million) by 19:41 UTC and sent 1,213,490 DAI ($1.21 million) into THORChain’s router in 64 deposits between 18:08 and 20:30 UTC, 59 of them for 18,000 to 22,000 DAI; the last two deposits sent back in the 15,292 DAI that THORChain had refunded on five earlier ones. THORChain paid the swaps out as 14.44319320 BTC ($1.2 million) in 64 payouts to three addresses Bitget lists, each payout naming its deposit in the memo of the paying transaction: bc1ql3uj9x3… took 1.32912863 BTC ($110,263) in six payouts from 18:25 UTC, bc1qv4zz7wa… 7.51216154 BTC ($623,201) in 32 from 19:37 UTC, and bc1qany9edq… 5.60190303 BTC ($464,728) in 26 from 20:26 UTC.

Three gatherings turned the payouts into three coins, each listed by Bitget in the minute it was made: 5.0 BTC ($414,795) at 20:14:21 UTC from 22 payouts, 5.0 BTC at 20:26:10 UTC from 21, and 4.44 BTC ($368,338) at 21:21:07 UTC from 21 payouts and the second gathering’s change. Two of the coins were mixed that night in rounds of the equal-output kind, which pay every participant one equal output and return the change, the kind that took two of the 7 October payouts at 05:23 UTC on 9 October: the 4.44 BTC went at 22:15:45 UTC into a round of 35 inputs and 15 outputs paying eight equal outputs of 4.43858547 BTC ($368,220), and the first 5.0 BTC at 22:36:51 UTC into one of nine inputs and nine outputs paying five of 4.99819267 BTC ($414,645). Every step from the bridge to the rounds is a transaction on Ethereum or Bitcoin on addresses Bitget lists, so the route is established; from the equal outputs on, the attacker’s share is read the way the other rounds are read, by where the outputs go.

A 5 BTC coin of it was split on 10 October, and 3 BTC went into an equal-output coinjoin

The second 5.0 BTC coin went through two more listed addresses at 03:33 and 03:36 UTC on 10 October to bc1q0s4g2497sd…, which paid it on at 15:15:21 UTC ($414,795) to a fresh address; at 15:17:56 UTC that address split it into 3.0 BTC for bc1qvn6fc6s7… and 2.0 BTC that reached bc1qrkvxkucr… through one more address. Bitget’s monitor saw the payment in the mempool at 15:14 UTC and listed each new address as its transaction confirmed, and the 2.0 BTC ($165,918) was still there at 20:30 UTC.

At 16:03:47 UTC the 3.0 BTC ($248,877) became one of 15 inputs to 0cfbff0830… (block 970,790), which took 170.43 BTC ($14.14 million) in all, 131.78 BTC ($10.93 million) of it from an address that a 33-input round of the same kind had funded four hours earlier, and paid 15 outputs: eight of exactly 2.99675757 BTC ($248,608) and seven of change, from 0.00447110 BTC ($371) to 128.78 BTC ($10.68 million). It is the same kind of round as the two of the night before: each participant takes one equal output and keeps the change, and the one who starts the round pays the fees. Two inputs of exactly 3.0 BTC went in, the attacker’s and one spent from a coin last moved in January, and the arithmetic fits either as the one that paid the round’s 0.00324243 BTC ($269) in fees and left with a single equal output, so the attacker’s share is read, as with every round on this page, by where the equal outputs go. The other 13 inputs came out of earlier rounds of the same shape, 6 to 37 inputs paying 10 to 22 outputs, among them an equal output of the 22:15 UTC round above and one of a round at 05:14:01 UTC that had taken two of the 7 October swap payouts (below). The first of the eight equal outputs was spent at 17:16:19 UTC into a transaction of 12 inputs and 18 outputs, nine of them exactly 0.0363 BTC ($3,011). Each step to the round is a spent output, so the route is established.

Timing and payouts link shielded Zcash to Bitcoin swaps

What the chain establishes through Zcash's private pool and the coinjoins

The short version. The visible transfers into coinjoins and into Zcash’s private pool, and the completed swaps, payouts and later payments that came out of them, join up at the points below. The newer Zcash exits lead to Bitcoin sold through Hyperliquid, a cash-out on TRON, a Maya Protocol route that paid a Bitcoin address Bitget lists, and an NFT sale whose proceeds reached a Bybit-labelled wallet. The onward transactions establish those public routes; their connection to the stolen Zcash is supported by the combined evidence.

What links the coinjoin outputs. A coinjoin combines inputs from several participants and pays outputs in repeated denominations, so the round itself marks no output as any input’s. Two kinds of later transaction do. A spend that takes a set of outputs together, with nothing else, puts them in one wallet, and where that set also sums to a listed input less a fee, the pair is recorded below. A plain spend with one output and no coinjoin structure has one signer under the common-input-ownership rule, so every input it gathers belongs to that signer. Common control stays an inference wherever a transaction could be collaborative: Bitcoin’s PayJoin specification explains how signatures from different owners can share one transaction. Later transfers to addresses independently listed by Bitget carry the attribution. Bitget’s tracker assigns some entire rounds to their first output, which overstates what the transaction establishes. The table records the observed spends.

Coinjoin (UTC) and what the attacker put in	Where it came out
12:23, 25 Sep 2.24486521 BTC ($188,608)	Its outputs were merged in the same block with other attacker coins into a 7.74 BTC output, spent the same afternoon
12:23, 25 Sep 0.56485361 BTC ($47,458)	Three outputs paid straight to addresses on Bitget’s list
25 Sep 4.6258 BTC ($392,009)	Candidate outputs were remixed, then gathered on 26 September into 2.00 BTC at bc1qqysfnpv… (09:47), 2.01 BTC at a listed collector (15:46) and 0.87 BTC at another (18:14); the 2.00 BTC became 168,176 USDT on TRON through THORChain
19:23, 26 Sep 6.24441232 BTC ($526,679)	Its outputs were merged in the same block into one 7.18 BTC output, spent in that block
19:37, 26 Sep 1.0722973 BTC ($90,442)	0.67108864 + 0.33554432 + 0.06566248 BTC is the input less 186 satoshi; spent together 16 minutes later into bc1qnrhu8fc…, 1.07217169 BTC, still unspent at 21:30 UTC on 5 October; Bitget listed the address by 30 September as a post-mix merge recovery address
20:20, 26 Sep 0.5413572 BTC ($45,660)	Three outputs spent together into bc1qtyh7eu…, on Bitget’s list, then into a 2.14 BTC parcel at 20:49
23:24, 27 Sep and 00:48, 28 Sep 1.58 and 1.77 BTC	Eight mixed outputs, three from the 00:48 round and one from 23:24, were gathered at 01:42 into 5.14756520 BTC at bc1q4gw6wz…, the coin Bitget’s tracker guessed at for the 00:48 round among them
02:42, 28 Sep 0.88104821, 0.87329889 and 0.06874157 BTC	Two of 0.86093442, two of 0.05 and four small denominations total 1.82308170 BTC, 697 satoshis below the three inputs; spent in the round’s own block into bc1qc305vx… (0.96443474 BTC) and, with the change, into bc1qsyp3w3… (0.85857316 BTC)
03:49, 28 Sep 0.8771031 BTC	0.5 + 0.28697814 + 0.09012322 BTC, the round’s only output of that last size, is the input less 174 satoshi; spent together at 04:17 into bc1qspdksc…, 0.87705416 BTC ($72,882), then remixed; its exit remained open at the last check
07:21, 28 Sep 1.19289137 BTC	Two inputs from addresses on Bitget’s list plus the 0.85857316 BTC exit of the 02:42 round, alongside two listed inputs; participation in the same coinjoin alone establishes no common owner
08:46, 28 Sep 4.98901885 BTC	The three exits above (bc1q9fyswsn…, bc1qc305vx… and bc1qspdksc…) went back in together; their later output ownership remains unresolved
03:38, 04:05 and 06:00, 5 Oct 0.979, 1.060 and 0.930 BTC from the Zcash-swap group	In the 04:05 round the input matches one 1.0 BTC output plus 0.06011205 BTC change less 162 satoshi; that change was spent at 07:50 with 32 other inputs into one 8.89 BTC output, among them 22 further fresh round outputs and five of the group’s own coins, which establishes those outputs as the group’s. The un-mix

What joins the new Zcash exits, 1 to 5 October. The completed swaps and onward payments provide four links readers can check:

• Bitcoin payouts join across two days. Twenty-seven swaps on 1 October exchanged 1,823.99 ZEC ($2.37m) for 30.72 BTC ($2.60m). Four of their payouts were spent together with a payout from a 30 September swap. That transaction establishes the link between those five payouts. Shared order settings support grouping the wider set. The joint spend and swap records.
• The Bitcoin proceeds reached TRON. Ten of those payouts funded six Unit deposits, putting 10.82 BTC ($917,000) into two Hyperliquid accounts. The sale records and onward transfers show the proceeds withdrawn to Arbitrum, converted into USDT0 and combined before a bridge paid 904,123 USDT ($904,123) on TRON on 1 October. The sale, bridge and receiving transaction.
• A second wallet swapped pool exits through Maya Protocol on 4 and 5 October, and on 6 October the listed receiver bought ZEC back through it. Fourteen pool withdrawals, 3,454.78 ZEC, reached one wallet whose Maya deposits name the attacker’s listed Bitcoin receiver and whose seven round payments went into the attacker’s listed shielding wallet; Maya’s memos and its own swap record pair every payout and refund to its deposit. On 6 October the listed receiver sent 7.1 BTC into Maya naming that wallet as the recipient, and the 447.16 ZEC it received went straight into the listed shielding wallet, which ties the wallet to the attacker at both ends. The route and the round trip.
• An NFT sale carried the ETH onward. Two completed Zcash-to-ETH swaps funded the NFT buyer. The same NFT bought for 0.14 ETH ($376) on 2 October sold for 219 ETH ($588,000) on 3 October. The token transfer, buyer’s payment and seller’s receipts establish the sale; the onward payments lead through four intermediary wallets first funded on 23 September to a wallet labelled “Bybit: Wallet 55” by Blockscout. The purchase, sale and onward payments.

The public paths are established. Their attribution to the Bitget theft is supported; common ownership of the NFT buyer and seller remains an inference.

What links the earlier Zcash swaps. Zcash publishes transparent transfers and the net value crossing its shielded pools, while shielded payments hide their individual amounts and recipients. Eight shielding transactions from the stolen ZEC have candidate exits into NEAR Intents swaps 20 to 40 minutes later. Timing, similar amounts and later Bitcoin payments to listed addresses support the links. The first 5.102 ZEC input and proposed 5.1 ZEC exit differ by 0.002 ZEC; their visible fees account for 0.0004 ZEC, leaving 0.0016 ZEC unexplained by those fees. All eight shielding transactions share one transaction shape, which points to one wallet build rather than one person, and the format keeps individual note values encrypted. The swaps carry a zodl referral tag, consistent with the Zodl integration. These observations support a route hypothesis; they do not identify one unique wallet or expose the private transfers. The Zcash section links the records.

Shielded (UTC)	Input and candidate swap payout	Paid to
19:42, 25 Sep	5.102 ZEC ($7,905) in 0.09343151 BTC out	bc1qcnd3k7x…, on Bitget’s list
21:38, 26 Sep	31.9895 ZEC ($52,734) in 0.62911496 BTC out	bc1qpcc4jf3…, swept into a listed address
23:20, 26 Sep	32.9569 ZEC ($54,328) in 0.63955895 BTC out	bc1qz4ztxxp…, swept into a listed address
00:52, 27 Sep	33.78 ZEC ($55,685) in 0.65282806 BTC out	bc1qpexcya8…, unspent and outside Bitget’s list
01:51, 27 Sep	34.49975 ZEC ($56,872) in 0.66568969 BTC out	bc1q4dp9zfd…, unspent and outside Bitget’s list
02:54, 27 Sep	35.23296 ZEC ($58,080) in 0.68022533 BTC out	bc1qdqrmku2…, unspent and outside Bitget’s list
04:24, 27 Sep	36.21764 ZEC ($59,704) in 0.69649636 BTC out	bc1q7w664wg…, unspent and outside Bitget’s list
05:19, 27 Sep	36.96336 ZEC ($60,933) in 0.71593181 BTC out	bc1qpcevqh7…, bc1q5uafy97… and bc1q3jz6fhj…, spent together at 16:07 UTC on 29 September into bc1qdw70v7c…, unspent and outside Bitget’s list

The eight shielding inputs total 246.74 ZEC ($406,749). The swaps provisionally linked to them paid 4.77 BTC ($404,506); the five addresses outside Bitget’s list in the table held 3.41116348 BTC of it, unspent, at 21:30 UTC on 5 October.

A later payment supports the link. At 05:11 UTC on 28 September the 5.15 BTC consolidation tied to the attacker in the table paid 2 BTC into bc1q8lnejq…, an address Bitget’s own map labels as the attacker’s, which sent it into THORChain for TRX nine minutes later; Bitget’s page logs that payment as a “Transfer between attacker addresses”, and by 12:47 UTC the 2 BTC was 166,000 USDT at a TRON receiving account. At 08:46 UTC the three attributed exits went into a further coinjoin together, and that round is being followed.

Tap anywhere in this box to close it.

A joint Bitcoin spend links swaps across two days

On 1 October, between 00:07 and 04:59 UTC, 27 NEAR Intents 1Click swaps received 1,823.99 ZEC ($2.37m) from the shielded pool and paid 30.72 BTC ($2.60m) to Bitcoin addresses. Their order settings share the zodl referral, capitalised Bitcoin recipients and a slippage tolerance of 200. The first completed order links its Zcash withdrawal to the Bitcoin payout.

At 14:12 UTC on 1 October, one Bitcoin transaction spent four of those payouts together with the payout of an 80 ZEC ($104,024) swap deposited at 23:58 UTC on 30 September. That directly links these five payouts and supports common control across both days. Attribution of the wider group to the Bitget attacker remains supported: its order settings resemble the earlier swaps whose Bitcoin payouts reached Bitget-listed addresses, and some proceeds followed the Unit and Hyperliquid route already used in the theft.

The Zcash-swap group’s Bitcoin balance on 4 October

At Bitcoin block 969,856, around 13:36 UTC on 4 October, twelve addresses holding payouts and change from the Zcash-swap group retained 42.99749234 BTC, quoted at $3.66 million using Chainlink’s BTC/USD round at 12:55 UTC. The largest holding was 21.74086444 BTC (about $1.85 million) at bc1q0etfvdrm…. The balance is visible on the public chain; the group’s attribution to the theft remains supported by the links described above.

The Zcash-swap group’s Bitcoin balance on 5 October

At Bitcoin block 970,059, around 18:13 UTC on 5 October, the group’s coins stood at 43.91 BTC ($3.75 million) across four addresses established as one wallet by spends, after ten of the twelve 4 October addresses moved that morning, as described in the coinjoin section. A further 9.68 BTC ($825,851) is supported by arithmetic and a same-block co-spend. The largest holding is unchanged: 21.74086444 BTC ($1.85 million) at bc1q0etfvdrm…. Prices: Chainlink’s BTC/USD round of $85,315.19 at 17:35 UTC.

10.82 BTC went through Hyperliquid and on to TRON

On 1 October, ten of the 27 Bitcoin payouts sent 10.82 BTC ($917,000) through Unit into two Hyperliquid accounts. Unit’s completed deposit records identify the accounts, 0x878a4217… and 0x9d82242D…. Both sold the credited Bitcoin on Hyperliquid and withdrew USDC to the same account addresses on Arbitrum.

The accounts swapped their USDC into USDT0. At 13:15 UTC, 0x878a4217… transferred its 401,199.99 USDT0 ($401,200) to 0x9d82242D…. The combined 904,394.69 USDT0 ($904,395) crossed the USDT0 bridge at 13:30, and 904,123.37 USDT ($904,123) arrived at TSjuvqHub… 39 seconds later. At 13:32, 800,000 USDT ($800,000) went onward to TC34F8Mz…, a hand-over address also reached by the 29 September Hyperliquid cash-out. The public transactions establish this path; its connection to the stolen Zcash follows the group’s supported attribution above. The BTC and USDT figures describe the same funds at successive stages of the route.

An NFT bought for $376 sold for $588,000

On 2 October, two shielded withdrawals of 300 ZEC each ($390,090) went through NEAR Intents 1Click and paid 300.56 ETH ($807,400) to 0x4A8EabE1…. The first completed swap and second completed swap name the same Ethereum recipient. Both carry the Zodl referral and slippage tolerance of 200. Those shared settings support the proposed connection to the theft.

The ETH passed through three wallets before the buyer paid 219 ETH ($588,000) on Blur for Credits NFT #40744 at 04:04 UTC on 3 October. Seller 0xc6B882b3… had bought that same token for 0.14 ETH ($376) at 09:22 UTC on 2 October. The sale paid the full 219 ETH to the seller, which sent it onward in seven payments within seven minutes. The large resale and rapid forwarding support a planned transfer through the NFT. The chain establishes the payments and token transfer; common ownership of buyer and seller remains an inference.

The proceeds travelled through 0xB59A7ADf…, 0xEB5eC8A2…, 0x9447c701… and 0x7BCe5F12… to 0xb0Ab4f3F…. The four intermediaries first received funds on 23 September, the day before the theft. On 3 October, the final address forwarded 157.6258 ETH and 59.8253 ETH, 217.45 ETH ($584,152) together, to a wallet labelled “Bybit: Wallet 55” by Blockscout.

Prices for these new routes: CoinGecko at 23:18 UTC on 3 October, ZEC $1,300.30, BTC $84,748 and ETH $2,686.36; USDT, USDT0 and USDC at $1. The transactions occurred on the dates stated above.

The NFT-funded wallet sent small payments to TRON

On 4 October, 0xB614079A…, a wallet funded by the buyer of the NFT described above, made two small payments through deBridge from Ethereum to the same TRON address, TVr2rSFu…. The buyer had sent its remaining 81.5553 ETH to this wallet on 3 October, quoted at about $220,000 using the 4 October ETH price.

deBridge’s first order and second order name the Ethereum sender and TRON recipient. The corresponding TRON transactions delivered the TRX at 05:57:54 and USDT at 05:58:27. These records establish the bridge route. Its attribution to the Bitget theft remains supported, through the earlier Zcash-to-ETH swaps and NFT funding path.

At the 13:37 UTC snapshot on 4 October, the Ethereum wallet still held 81.34386618 ETH, quoted at $219,418 using Chainlink’s ETH/USD round at 13:16 UTC. At 18:17 UTC on 5 October the balance was the same to the wei, $219,503 at Chainlink’s 17:16 UTC round, with the 4 October bridge payments still the wallet’s latest transactions. The TRON payments and this remaining balance describe portions of the funds already traced through the NFT buyer.

At 19:37 UTC on 7 October the wallet sent 0.03892217 ETH ($97) to a fresh address, which passed 0.03891764 ETH on at 10:00 UTC on 8 October to 0xb21B7C28…, a wallet with more than 158,000 transactions. At 11:00 UTC on 9 October the wallet still held 81.304936638956 ETH ($202,637), with that payment still its latest.

Two TRON payments reached a collection address

On 4 October, the TRON recipient of the NFT-funded wallet’s bridge payments, TVr2rSFu…, sent 281.2 USDT ($281.16) to TQ9r6w4F…. The two confirmed transfers were:

At 15:43 UTC, the receiving address held 848.814 USDT ($848.70), including other receipts. Its last outward USDT transfer was on 28 September, so the two 4 October payments remained there at that check, and at 18:17 UTC on 5 October it held 871.89 USDT after two more small receipts from other payers, still with no sweep since 28 September.

The address’s three earlier USDT sweeps, on 30 July, 30 August and 28 September, travelled through two intermediaries to TG2CMGxn…, labelled “Kraken: Hot Wallet” by Tronscan. The September pair shows the collection address paying an intermediary, then the intermediary forwarding the same amount 90 seconds later. That is an older route, preceding the 4 October payments, whose visible destination at the 5 October read is still the collection address.

Zcash change links an attacker wallet to an ETH swap

A 0.381 ZEC swap on 30 September has a direct public link to the attacker: its deposit transaction spends change left by an address Bitget identifies as an attacker wallet. The completed swap paid 0.20249597 ETH to 0xa5181a3e2ab73e9cf0d6c02d5abbd02aa081304f, which still held that amount at 19:15 UTC.

The link is a particular spent output. When the attacker wallet put ZEC into the private pool, it kept a small amount as public change. The later swap deposit spends that same change, alongside money withdrawn from the pool.

NEAR Intents’ completed order links the Zcash deposit and Ethereum payout and records the referral as SwapKit. The two Zcash spends disclose the same signing public key. Together, the exact change output and completed order establish the attacker wallet’s involvement in the deposit transaction and its route to Ethereum. The shielded component’s earlier note history remains private.

A second swap used the same refund address. A 1 ZEC swap through NEAR Intents, whose Bitcoin payout confirmed at 14:18 UTC the same afternoon, named t1HzMZJn… as its refund address, the same as the 0.381 ZEC order. That address first appeared on the Zcash chain on 5 October, when the main stolen wallet’s drain into the shielded pool paid it 670 ZEC. Using it as a refund address five days before it was funded points to one wallet or operator behind both orders and that drain. The 1 ZEC swap ($1,365) paid 0.01712346 BTC ($1,465) to bc1qhl3gwfgy…, which Bitget lists as the Bitcoin refund address of Chainflip liquidity account 1689, one of five such accounts it attributes to the attacker. That coin was swept on 1 October into bc1qjkpflwt…, also on Bitget’s list. The 0.381 ZEC deposit is the only spend from the Zcash addresses Bitget lists as the attacker’s that combines money from the private pool with visible change.

A smaller return crossed between two private pools

At 22:45 UTC on 29 September, a withdrawal from Zcash’s Sapling pool paid 0.76873560 ZEC directly to known attacker wallet t1gNZpuHEpST6Yu99y1tVb9nKXetkinFgXg. At 23:08 UTC, that exact output was spent into Ironwood, another Zcash private pool, with 0.76858560 ZEC shielded after the fee. The public steps show funds returning to an attacker wallet and entering a different pool.

760 ZEC returned to an attacker address on 30 September

A 760.0551 ZEC withdrawal (about $1.18 million) from Zcash’s shielded pool at 08:48 UTC on 30 September has a visible onward link to the attacker. It paid t1TBuaY7W94uTN4QgJRL6aV1ED4tCznFj3b, which later sent the funds to t1gNZpuHEpST6Yu99y1tVb9nKXetkinFgXg, an address Bitget lists as the attacker’s and which also received transfers directly from the main stolen Zcash wallet.

The public trail establishes the return to a known attacker address and the subsequent shielding. Assigning that withdrawal to a particular earlier deposit requires evidence across the hidden part of the route. The receiving address was empty at the midday check; the return reuses funds already in circulation.

Five transfers moved 2,923.75 ZEC into shielding

Between 08:13 and 11:14 UTC on 30 September, the main stolen Zcash wallet sent 2,923.74808554 ZEC to three intermediary addresses. Their subsequent transactions put 2,923.74723554 ZEC into the shielded pool after fees, about $4.54 million at Bitget’s fixed valuation rate.

At the 12:15 UTC check on 30 September, the main wallet retained 15,657.42957764 ZEC. The five rows count the new transfers from that wallet. The separate 760.2748 ZEC return above is a second pass through shielding. Bitget’s ledger valued funds in its mixer category at $8.89 million in the 12:15 UTC snapshot.

Five late transfers moved another 3,007.33 ZEC

Between 23:22 and 23:50 UTC on 30 September, the main stolen Zcash wallet sent 3,007.32932542 ZEC to two known attacker addresses. By 00:34 UTC on 1 October, 1,004.02412847 ZEC from these transfers remained transparent at t1gNZpuHEpST6Yu99y1tVb9nKXetkinFgXg. The other three outputs were spent in two shielding transactions.

The main wallet retained 8,582.56097993 ZEC after these transfers, the balance it held until it emptied on 5 October. These transfers reduced its visible balance while keeping the two transparent recipient outputs traceable.

The final 1,004 ZEC went into Ironwood on 3 October

At 14:55:13 UTC on 3 October, known attacker wallet t1gNZpuH… spent its last two transparent outputs, 476.54024696 and 527.48388151 ZEC, into Zcash’s Ironwood shielded pool: 1,004.02412847 ZEC ($1,303,414) in, with no transparent output, leaving the address empty. Bitget’s tracker cut its Zcash count to 8,582.56 ZEC ($13.32 million at its fixed rate), the balance of the main stolen wallet t1WgMdt…, which had last moved at 23:50 UTC on 30 September. At the 15:17 UTC snapshot on 3 October, Bitget counted only the main wallet’s transparent Zcash balance. The dated routes below distinguish direct public links from inferred connections across shielding.

Another 468.65 ZEC returned to an attacker wallet

At 19:19:46 UTC on 30 September, a shielded withdrawal paid 468.65 ZEC directly to known attacker wallet t1gNZpuHEpST6Yu99y1tVb9nKXetkinFgXg. At 19:23:06, the recipient spent that exact output into shielding again. This is another visible return to an attacker address followed by re-shielding, alongside the 760 ZEC cycle earlier that day. It counts a further passage through the pool of funds already in circulation.

The 29 September 44.03 ZEC batch has three candidate Bitcoin exits

At 16:05 UTC on 29 September, the known Zcash pile peeled off 44.03 ZEC and 44.02975 ZEC entered the shielded pool. Three later NEAR Intents orders withdrew 44.028 ZEC from the shielded pool and paid 0.73265747 BTC in all:

The two resting wallets held 0.71261358 BTC together, about $59,600 at the stated 19:20 BTC price. The separate 0.02 BTC split is excluded from that balance. The 0.00175 ZEC difference between the shielded amount and these swap deposits, the timing and the later joint Bitcoin spend support the proposed route. Because Zcash hides individual shielded transfers, those facts do not prove which shielded notes funded the three orders. The zodl swap tag is shared by other Zcash wallet users.

Three later pieces entered the pool on 29 September

The visible pile sent a further 44.77 ZEC through a split-off address. Its 1.23248122 ZEC shield at 18:06, 26.36490855 ZEC shield at 18:11 and 17.17167577 ZEC shield at 18:32 total about 44.77 ZEC before fees. Those three pieces are counted as still inside the pool: through 21:30 UTC no completed swap was attributed to any of them, and the orders carrying the same zodl tag in those hours belong to the wider body of that wallet’s users.

The main visible Zcash address held 18,581.17866318 ZEC at 20:26 UTC on 29 September after these peels. The 44.03 ZEC batch above and these three later pieces are distinct; the three later pieces are not counted as established Bitcoin exits.

Five inferred exit wallets held 3.41 BTC at 17:21 UTC

The five remaining recipients of the earlier inferred Zcash route held 3.41116348 BTC at 17:21 UTC on 29 September. At 16:07 UTC, three earlier payout outputs were spent together into bc1qdw70v7cnnddjgal4yrcyppc997mjs2vjkfnge7, which held 0.71592404 BTC. That joint spend supports common control of those Bitcoin payouts; their connection across Zcash’s shielded pool rests on the route evidence below.

The known Zcash vault made a further 44.03 ZEC peel at 16:05 UTC. After the shielding transaction’s fee, 44.02975 ZEC entered the private pool, leaving 18,625.94832872 ZEC in the visible vault at the later check. The three candidate withdrawals and their onward Bitcoin spends are detailed above. The peel and shielding transaction record the public steps.

The earlier shielding and swap evidence

At the 15:05 UTC check on 29 September, Bitget’s main Zcash address still held 18,669.97872872 ZEC and had made no outgoing transfer since its large receipt at 06:47 UTC on 27 September. A 0.0295 ZEC incoming dust payment at 08:40 UTC on 27 September was its latest event. The candidate Bitcoin payout wallets from the eight earlier Zcash swaps remained unspent at the afternoon check. Seven of those payout addresses, holding 3.41 BTC between them, sat outside Bitget’s address list, and they still did at 18:17 UTC on 5 October. These observations keep the large ZEC balance distinct from the smaller earlier shielding route.

The Zcash address Bitget names, t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG, spent for the first time at 19:10:52 UTC on 25 September. One transaction sent 5.102 ZEC (about $7,905) to a new address and returned 18,911.62 ZEC (about $29.30 million) to the same address as change. At 19:42:47, the 5.102 ZEC, less its network fee, moved into Zcash’s shielded pool. Amounts entering and leaving the pool are public; payments made inside it hide their amounts, senders and recipients.

At 20:16:48, 34 minutes later, exactly 5.1 ZEC ($7,901) left the shielded pool for t1fS1ioAwXx2272mcKHjTNrbfunRo7Ke1bC, the deposit address of a NEAR Intents 1Click swap. NEAR Intents’ public record of that swap shows it completed and paid 0.0934 BTC ($7,918) to bc1qcnd3k7xkp7lxzdcg74zffgkp38v0gfvju4v086, an address on Bitget’s attacker list, in Bitcoin transaction 9ad04aac…. The swap carries the referral tag zodl, the tag of Zodl, formerly Zashi, the Zcash mobile wallet built by the Zcash Open Development Lab, which has NEAR Intents swaps built in. That Bitcoin was later swept into bc1qg9zl9s8zq2vhdk8f2e8dyt5w5xguwz7l20auyl, also on Bitget’s list. The later sweeps of t1fS1io… into t1dt498t… at 03:07:48 UTC on 26 September and on into t1PKBiv7… at 04:36:02 were NEAR Intents’ own Zcash custody collecting its deposits.

Between 21:36 UTC on 26 September and 05:19 UTC on 27 September, seven more pieces left the main pile and were shielded within minutes. Timing and similar amounts link them provisionally to seven NEAR Intents swaps carrying the Zodl referral tag. Across the eight proposed pairs, shielding inputs total 246.74 ZEC ($406,749) and swap payouts total 4.77 BTC ($404,506). The first pair leaves 0.0016 ZEC beyond the visible fees, so these are approximate amount links across the pool:

All eight shielding transactions share one transaction shape. The transaction format exposes that shape while encrypting individual note values, and a shared shape can come from the same software used by different people; the zodl tag identifies the swap integration. The eight swaps paid out to 10 Bitcoin addresses. The main pile, t1WgMdt…, held 18,669.98 ZEC ($30.01 million) at 21:50 UTC on 27 September.

The main Zcash wallet moved 8,582 ZEC into the shielded pool on 5 October

Between 06:32:43 and 12:37:18 UTC on 5 October, the wallet Bitget names as the main Zcash recipient, t1WgMdtND8…, sent its whole balance of 8,582.56 ZEC ($11.33 million) away in 29 transactions, each paying one slice to a recipient and returning the rest to itself. The first send and the last bracket the run; the wallet held 0.00067931 ZEC afterwards.

Every shielding went into the Ironwood pool with the transaction shape of the shieldings of 30 September to 3 October. Bitget’s tracker listed the four new intermediaries as attacker downstream addresses within the day. Fresh money entering the pool since 30 September stood at 18,581 ZEC ($24.54 million) at the 5 October read, before the 447 ZEC round trip of 6 October; the 2,319 ZEC that the listed wallet also re-shielded on 5 October came out of the pool first and is counted once. The transfers and shieldings are on the public chain, and the wallets carry Bitget’s own attribution.

A second wallet swapped pool exits through Maya Protocol to a listed Bitcoin address

Between 15:32 UTC on 4 October and 11:01 UTC on 5 October, a Zcash wallet first funded on 3 October, t1f4d9KVnE…, received fourteen withdrawals from the shielded pool totalling 3,454.78 ZEC ($4.56 million), and 195 ZEC ($257,505) more through two relay addresses that each passed a pool withdrawal on in one hop. Each withdrawal came out of the Ironwood pool with the transaction shape of the Zcash-swap group’s 30 September and 1 October exits. The two largest are the 967.43 ZEC ($1.28 million) exit at 07:46 UTC and the 958.01 ZEC ($1.27 million) exit at 08:45 UTC.

The wallet sent 3,619.2 ZEC ($4.78 million) into Maya Protocol’s Zcash vaults in 28 deposits, each carrying a memo instructing a swap to Bitcoin paid to bc1qh2mlug08…, the address Bitget’s tracker labels as the attacker’s cross-chain exit receiver. Maya Protocol is a cross-chain swap network built from THORChain’s code, with the same memo grammar and Zcash among the chains it serves, and its own public swap record for this wallet lists every deposit, refund and payout in this section. Maya refunded 17 of the deposits with refund memos, 2,299.43 ZEC ($3.04 million) in all, so 1,319.78 ZEC ($1.74 million) was swapped. Maya’s payouts name the deposit they settle: twenty payouts on 5 October delivered 19.69 BTC ($1.68 million) to the listed address. One complete sequence: a 305 ZEC ($402,765) deposit at 11:11 UTC, its 2.2077 BTC ($188,352) payout at 12:32 UTC and the 156.82 ZEC ($207,087) refund at 12:21 UTC.

The same wallet paid 2,319 ZEC ($3.06 million) in seven round amounts (208, 300, 299, 227, 185, 960 and 140 ZEC) between 04:27 and 11:27 UTC to t1gNZpuHEpST…, the listed wallet that shielded 1,004 ZEC on 3 October, which re-shielded every payment within half an hour, most of them within ten minutes; the 960 ZEC ($1.27 million) payment is the largest.

The pool withdrawals into this wallet, its deposits into Maya Protocol, Maya’s refunds and Bitcoin payouts to the listed receiver, and its payments into the listed shielding wallet are all on the public chain and in Maya’s record, so the route is established. At the 5 October read the wallet’s connection to the theft was supported, on three grounds: its swap proceeds landed on the address Bitget lists as the attacker’s exit receiver, it funded the attacker’s listed shielding wallet with $3 million in round amounts, and its withdrawals share the swap group’s wallet build. The next morning the listed receiver sent Bitcoin back through Maya to this same wallet, and the wallet passed the proceeds to the listed shielding wallet. That round trip, described next, establishes the wallet as under the attacker’s control. Bitget’s tracker carries the Bitcoin side of this route, and this section supplies the Zcash side.

The listed receiver bought 447 ZEC back through Maya Protocol and shielded it

At 08:50:55 UTC on 6 October, bc1qh2mlug08…, the Bitcoin address Bitget lists as the attacker’s cross-chain exit receiver, gathered 9.23494858 BTC ($795,191) from six coins and, in the same block, sent 7.1 BTC ($611,357) into Maya Protocol’s Bitcoin vault with a memo ordering a swap into ZEC paid to t1f4d9KVnE…, the wallet of the section above. The 7.1 BTC filled 5.6975 BTC of the order before the tail missed its price limit, so Maya refunded 1.4024677 BTC ($120,762) at 09:33 UTC, and at 09:45 the receiver sent 1.4 BTC ($120,549) back in with the same instruction. Maya swapped 7.0975 BTC ($611,145) in all into 447.16 ZEC ($615,765). The receiver held 2.1377 BTC ($184,072) afterwards.

Of the 9.23 BTC gathered, 5.52 BTC was pool money coming back: Maya’s 5 October payouts for the swaps described above, forwarded through two addresses Bitget lists as attacker downstream. The other 3.71 BTC ($319,463) was fresh, withdrawn on 5 October from two high-volume hot wallets: one labelled by Bitget as KuCoin’s, the other, labelled as HitBTC’s Bitcoin hot wallet in the attribution data read on 6 October, the wallet that five days earlier had funded, one hop before, the 8.68 BTC coin the swap group is supported as holding. So the 447.16 ZEC that re-entered the pool is part pool money returning and part new money, and one consolidated deposit carries both: fresh money in the pool since 30 September is between 18,581.16 ZEC ($25.59 million), counting the round trip once as the 5 October re-shields were counted, and 19,028.32 ZEC ($26.20 million), counting the 447.16 ZEC as new. Both bounds are established on chain, and the true figure sits between them.

The route is established at every step: Maya’s own record lists both deposits, the refund and both payouts, the memos pair each payout and refund to its deposit, and the spends are on both chains. The wallet’s connection to the attacker moves with it. At the 5 October read it was supported, on the grounds set out in the section above. Now the key behind the attacker’s listed receiver has signed a swap order naming t1f4d9KVnE… as the destination for his Bitcoin, and the wallet has passed every zatoshi of the proceeds to his listed shielding wallet within an hour. Money that leaves a listed wallet and arrives at another listed wallet through this address, in both directions, makes it his address or his instrument, so its control is established by the round trip; the one residual reading, a custodian acting on his instructions, still makes the money his. Bitget’s own event feed logged both deposits with the memo naming the wallet.

Twenty-four round parcels were one venue’s deposit addresses

At 03:44:48 UTC on 6 October, one transaction spent 125 transparent inputs into a single output of 1,240.45 ZEC ($1.71 million) at t1Zzkb4eGARP…. Among the 125 inputs are six parcels of 21 to 25 ZEC (142 ZEC, $195,543) that left the shielded pool on 3 October and had sat unspent on fresh addresses since, and 18 of the twenty parcels of 20 to 50 ZEC (409 ZEC, $563,218) that left the pool on 5 October. Twenty-three of the 125 inputs were pool exits of 5 and 6 October, 482.13 ZEC ($663,922) in the same transaction shape as the swap group’s exits; the other 102 are older deposits, 65 of the 125 amounts are whole numbers, and they run from 1.0 to 38.5 ZEC.

The output address is a sweep wallet: 2,470 transactions and 3.57 million ZEC received, gathering deposit addresses in batches of 8 to 487 inputs (46 on 1 October, 21 on 2 October, 65 on 3 October, 125 and 14 on 6 October) and paying round amounts of 100 to 500 ZEC on to t1cArVf7BgN3…, a hot wallet with 142,304 transactions and 21.3 million ZEC through it that pays withdrawals to users in odd amounts. Both addresses sit outside Bitget’s list. A sweep that spends 125 addresses together puts them in one wallet, so the parcels resolve as deposits to one custodial venue, established by the common-input sweep: the fresh addresses were the venue’s deposit addresses, and each parcel was a customer deposit. Whether the 125 depositors are one person placing 20 to 50 ZEC deposits or many customers is a question the venue’s records answer. The depositor’s connection to the theft stays possible, on the wallet build and the round amounts, and the sweep has given it a counterparty to ask. Two of the twenty round parcels, 49.0 and 50.0 ZEC, and a 30.26 ZEC exit of the same shape are still unspent, 129.26 ZEC ($177,996) together, and a second sweep of 14 inputs at 13:42 UTC on 6 October took two more of that morning’s 20 to 24 ZEC pool exits the same way.

The venue is labelled as HitBTC. In the attribution data read from Arkham Intelligence on 6 October, t1Zzkb4eGARP… carries HitBTC’s label as a hot wallet, t1cArVf7BgN3… carries the same, and all 26 parcel addresses swept that day, the six of 3 October, the eighteen of 5 October and the two of the 13:42 sweep, carry the label “HitBTC Deposit”. The three unspent parcels of the same shape sit in that data as plain addresses. The same data labels the Bitcoin hot wallet that paid 2.10 BTC ($180,956) into the attacker’s 6 October swap as HitBTC’s, so one exchange appears on both sides of this record: paying a withdrawal to an address Bitget now lists, and taking the round parcels on deposit. The sweep is established on chain and the venue’s name rests on Arkham’s label; the depositor’s connection to the theft stays possible, and the exchange’s deposit records are what would settle it.

Where the Zcash exits ended up

Attribution labels, risk scores and counterparty tables were read on 6 October for the 187 addresses gathered in the 5 and 6 October trace, on Bitcoin, Zcash, Ethereum and TRON. Sixty-one came back with a label, four of them as “Bitget Hacker”, and the risk engine scored the Bitget-listed wallets the case starts from as SEVERE seeds. The exit groups those labels touch, where each ended up, and what the label says about the destination:

Arkham’s “Bitget Hacker” entity holds 3,717 addresses, with $7.14 billion of volume through them and $349.2 million held at the 6 October read; its history starts in March 2025, so it carries activity from before the theft. Four of the addresses in this record are inside it, and they are the Bitget-listed wallets the case starts from: the exit receiver bc1qh2mlug08…, the hoard bc1qeqp6390m…, the TRON wallet TCThtz9Q… and the shielding wallet t1gNZpuHEpST…, each scored SEVERE. The wallets this record reached by following the money onward sit in that data as plain addresses: t1f4d9KVnE…, the swap group’s resting coins and the TRON hub among them, and the ones put to the risk engine, t1f4d9KVnE… and the two largest resting coins included, scored NONE. The counterparty table for t1f4d9KVnE… records $5.72 million of two-way volume with one Maya Protocol vault over 34 transactions and $3.69 million paid out over eight transactions on 5 and 6 October to the shielding wallet labelled “Bitget Hacker”, the 6 October round trip among them. The labels name the venues at the edges of the trail, and the chain supplies the hops between them.

The same read put a name on the first TRON funding. The Relay.link bridge solver TYVWGh8X… paid the listed TRON wallet TCThtz9Q… its first 78.22 TRX ($26) at 08:17 UTC on 25 September, the morning after the theft, and later paid the first TRX of the 5 October run’s hub TADMRLDAXjm1… and of its relay TEHT9eFwkp9X…. Arriving on TRON through the same bridge is a habit the listed wallet and the run share; a public solver with half a million transactions carries that as support for the run’s attribution, which stays supported.

Ninety-five orders placed straight through NEAR Intents’ API put 2,619 ZEC into TRON USDT

Between 10:49 UTC on 5 October and the end of that day, 95 swap orders placed straight against NEAR Intents’ order API, with the referral field left empty, took 2,619 ZEC ($3.61 million) out of the shielded pool and bought USDT on TRON. The run opened with six small orders of 0.1 to 1.85 ZEC, then ran at 26 to 35 ZEC an order, all 74 of the later orders at a slippage tolerance of 50, almost all in the swap group’s transaction shape, each paid to a fresh TRON address of its own. NEAR’s TRON hot wallet paid the full-size recipients 32,295 to 46,469 USDT each within hours. Between 22:13 and 22:41 UTC on 5 October, 90 of the recipients, each given its gas by one wallet and sending with the same fee limit, forwarded their payouts one every twelve seconds into a single address created that evening, TADMRLDAXjm1…, which sent 3,421,003.77 USDT ($3,420,696) on at 22:41:57.

All of these TRON addresses sit outside Bitget’s list. The order shape is the swap group’s build at the tolerance of its second phase, with its test-then-send habit, and the cash-out churns through the USDD peg module that Bitget’s listed TRON downstream wallets have used since 1 October. Against that, the order amounts are wallet-computed rather than round, the orders were placed through a different swap client, and the relay network behind TEHT9eFwkp9X… serves more senders than this run. Every payout swept into one address and onward together establishes the run as one operator’s. NEAR Intents’ own order records then tie that operator to five orders placed on 1 October between 03:23 and 04:41 UTC, inside the window of the attacker’s capitals run and three of them within 19 to 79 seconds of a capitals order: the 300,597 USDT ($300,570) those orders paid into TQPowg3g… went back through the service twice on 5 October, USDT to TRX and back, with the same recipient and refund addresses on both legs, landed at the address the run’s own test orders had paid, and moved on at 12:31 UTC to TTfuKYa9…, which held 213,113 USDT ($213,094) at 15:28 UTC on 6 October. The operator’s connection to the theft is supported; a shared key between one of the 1 October deposits and a capitals deposit would establish it. The million-dollar parcels went into an over-the-counter desk operation that pays out within the hour.

One more exit from the same window went into Bitget’s own Zcash wallet, test first. At 03:25 UTC on 6 October a 0.1 ZEC exit landed on a fresh address, was relayed in the same block to t1dZ7pmMKEqT…, and at 03:58 that address paid 0.09985 ZEC into t1Xd1Lx2EXi2…, which Bitget’s tracker labels as Bitget’s own ZEC wallet; at 07:26 a 100.0001 ZEC exit took the same path, and at 08:06 99.99985 ZEC ($137,706) went into Bitget’s wallet. The route is established on chain; the money arrived through a Bitget deposit address, so Bitget can name the account behind it, and that depositor’s connection to the theft is possible. The attribution labels read on 6 October carry t1Xd1Lx2EXi2… as Bitget’s hot wallet, as the tracker does, and t1dZ7pmMKEqT… as a Bitget deposit address, which the tracker leaves unlabelled.

Thirteen more swaps with the recipient typed in capitals, and three stuck 100 ZEC orders

Between 06:58 and 08:36 UTC on 5 October, thirteen Zcash-to-Bitcoin swaps with the Bitcoin recipient typed in capitals took 661.96 ZEC ($874,146) out of the pool and paid 8.57 BTC ($731,431). Three carry the 1 October group’s exact settings: round amounts of 65, 65 and 100 ZEC, a slippage tolerance of 200 and the same wallet build; the other ten run at a tolerance of 50 or 100. Twelve payouts settled; ten were gathered within half an hour into four addresses, and two, 0.993 and 0.994 BTC ($84,738 and $84,828), were still unspent on their payout addresses at 21:45 UTC on 5 October. The first gathering, at 07:21 UTC, also spent a 3.14572899 BTC ($268,378) payout from a Chainflip Bitcoin vault, so this wallet combines swap payouts with a Chainflip vault payout in one spend; Bitget describes the hoard itself as built from Chainflip payouts.

The 100 ZEC ($132,054) order was still processing at 18:20 UTC, past its deadline, and changed to a failed state at 07:43 UTC on 7 October with nothing refunded. The two 100 ZEC orders placed on 3 October, to TRON USDT and to Ethereum USDT, both changed to a failed state at 08:14 UTC on 5 October with their deposits held by the swap service; their refund addresses are shielded receivers, so a refund would appear only as a shielding from the service’s custody. The 5 October order and the 3 October TRON order carry the group’s order settings, so their attribution to the group is supported; the Ethereum twin shares the amount and the test-then-send timing but ran at a different tolerance, so it is possible. Their connection to the theft follows the group’s supported attribution. All three orders have now failed, the two 3 October orders on 5 October and the 5 October order at 07:43 UTC on 7 October, with nothing refunded and every deposit still held by the service, each 100 ZEC and $137,706 at the 6 October price. A separate 5 October run of 50 swaps placed through the SwapKit front end, 3,302.7 ZEC ($4.36 million at the 5 October price) into 50.25 BTC, gathered its payouts within minutes and forwarded them to ten fresh addresses; one forward of 3.925 BTC ($337,989) entered Chainflip at 19:12 UTC that evening, where Chainflip’s Bitcoin vault spent it together with its own coins, which shows the address was a Chainflip deposit channel; the asset it bought sits in Chainflip’s records. That run shares the swap group’s transaction shape and ran in the same hours, under a different front end and different settings, so it is possible as the group’s.

Thirty-three more swaps with the recipient typed in capitals on 7 October

Between 00:34 and 06:57 UTC on 7 October, 33 Zcash-to-Bitcoin swaps through NEAR Intents, each with the Bitcoin recipient typed in capitals, took 804.0478 ZEC ($980,689) out of the shielded pool and paid 12.5612066 BTC ($1.03 million) to 33 addresses with no earlier history. Each order’s deposit address, recipient and payout are in NEAR Intents’ order records (the first order). All 33 carry the Zodl app’s referral tag and fee, fourteen of them for exactly 30 ZEC, and the payouts ran from 00:51 UTC to 07:26 UTC. Among 1,619 earlier swap orders checked, all 41 with a recipient typed in capitals belong to the set already linked to the Zcash-swap group, so the run’s attribution to that group is supported.

The first payout, 0.24401935 BTC, was split at 06:58 UTC on 7 October into 0.01 BTC ($823) and 0.234 BTC ($19,265), and the 0.01 BTC piece entered a coinjoin of 12 inputs and 13 outputs at 02:52 UTC on 8 October. Apart from that piece, the run’s Bitcoin was unspent at 13:10 UTC on 8 October.

Two of the run’s payouts were spent together at 00:55 UTC on 9 October. One transaction (block 970,558) spent the 0.29540529 BTC ($24,374) at bc1qrpk8zmq… and the 0.23401794 BTC ($19,309) at bc1q364mxm7… into one fresh address, 0.52941967 BTC ($43,682). Spending both coins in one transaction takes both keys, so one key holder received both swaps’ payouts: established. At 05:23 UTC that coin went into a coinjoin of 22 inputs and 17 outputs, nine of them for exactly 0.53120103 BTC. The run’s other 31 payouts held 12.02178196 BTC ($991,911) at 11:00 UTC.

Five more of the 7 October payouts were spent, on 9 and 10 October

At 23:41:32 UTC on 9 October, one transaction (block 970,692) spent two of the run’s payouts, 0.40279719 BTC ($33,416) at bc1qudrmh0u… and 0.47482962 BTC ($39,391) at bc1qdy0hu9c…, into one fresh address, 0.87762325 BTC ($72,807), and at 05:14:01 UTC on 10 October that coin went into a coinjoin of 34 inputs and 17 outputs, nine of them exactly 2.86108621 BTC ($237,353): the equal-output kind described above. At 14:58:53 UTC on 10 October, another (block 970,779) spent three more, 0.46385795 BTC ($38,481) at bc1q6kv4lchh9s…, 0.46417274 BTC ($38,507) at bc1qt4ahzxnzck… and 0.42022336 BTC ($34,861) at bc1qw08g39vcj0…, into bc1q6yz636eawn…: 1.34824667 BTC ($111,849), unspent at 20:30 UTC. Spending two or three coins in one transaction takes every key, so one key holder received each group’s payouts: established, as with the pair spent together at 00:55 UTC on 9 October. Seven of the 33 payout addresses have now been emptied, the first on 7 October, one at 00:55 UTC on 9 October together with the remainder of the first, two at 23:41 UTC that night and three on 10 October, and the other 26 held 9.79590110 BTC ($812,658) at 18:00 UTC.

Three wallets outside Bitget’s list held $426,029 on 2 October

At 15:19 UTC on 3 October the two Bitcoin wallets still held 4.37667906 BTC ($371,144) and 0.59110535 BTC ($50,126), each with the one transaction in its history. TYjFB3sT… moved money on 2 and 3 October, described below, and held 1,499.35 USDT, 2,825.14 USDD ($2,823) and 158.82 TRX ($53), $4,376 together. All three sit outside Bitget’s list, which carried 4,881 addresses at 15:17 UTC on 3 October. At 18:17 UTC on 5 October the two Bitcoin wallets were unchanged and TYjFB3sT… held 1,069.41 USDT, 4,212.14 USDD ($4,209) and 117.88 TRX ($40), $5,318 together, after a 2,985 USDT payment and a 2,825 USDD-to-USDT swap on 4 October, 4,212 USDD received from a listed wallet the same day, and four small USDT payments on 4 and 5 October; all three remained outside the list, then 4,940 addresses.

Three wallets outside Bitget’s 4,852-address list held $426,029 of the stolen money at 15:49 UTC on 2 October. Two hold Bitcoin, which nobody can freeze. The third holds USDT on TRON, which Tether can freeze.

Bitcoin at Chainlink's BTC/USD of $85,546.69 (14:55 UTC on 2 October); USDT at $1.

How the 4.38 BTC traces back

1. 19:35 to 19:40 UTC, 25 September. The TRON wallet TT5BpBpN… paid 10 USDD and then 299,990 USDD to TBrWTrJu…, one of the funding wallets in the next section, and the same two amounts to THY2HMDa…. A small test payment before each large one is a habit the attacker shows throughout this trace.
2. 19:18 and 19:49 UTC. THY2HMDa… paid 9,900 USDT into one Chainflip swap and, after swapping the USDD for USDT, 370,000 USDT into a second. It named itself as the refund address on both.
3. 19:28 and 20:04 UTC. Chainflip paid the Bitcoin to bc1qqkv4xmh…: 0.11708532 BTC from the first swap and 4.37668346 BTC from the second.
4. 19:38 UTC. bc1qqkv4xmh… sent the smaller coin, with 0.0011408 BTC more it held, into bc1qa00g3nc…, which Bitget lists as the attacker’s.
5. 20:40 UTC. It moved the 4.37668346 BTC coin whole into bc1qqzj2aa…, where it has stayed.

Both payments were authorised by the same public key for bc1qqkv4xmh…. That directly connects the 4.38 BTC payment to the address that also paid Bitget’s listed attacker wallet.

How the 0.59 BTC traces back

1. 26 and 27 September. TYjFB3sT…, the wallet in the next route, paid 50,000 USDT and then 60,000 USDT to TCY4jHmH…, a TRON wallet created on 26 September. Within minutes each time, TCY4jHmH… paid the same amount into a Chainflip swap, naming itself as the refund address.
2. 08:15 UTC, 27 September. The 60,000 USDT swap paid 0.7036936 BTC ($60,199) to 1PvfuiQb…, which moved it in one piece at 08:21 into bc1qdphrvt…, a wallet Bitget lists as the attacker’s.
3. 16:46 UTC, 26 September. The 50,000 USDT swap paid 0.59111635 BTC ($50,568) to bc1q4j65elk…, and a sweep in the same block moved it to bc1qqcqyz87….
4. 15:59 UTC, 27 September. TCY4jHmH… paid 127.73 TRX of fees to TQP1FAjx…, the TRON wallet that later received the attacker’s USDT in the next route.

How the 1,051 USDT traces back

TYjFB3sT… is also the wallet that funded both Chainflip swaps in the 0.59 BTC route, so the 0.59 BTC and the 1,051 USDT trace back through the same wallet.

The wallet is still in use. At 17:57 UTC on 2 October TCFoaAXk…, a wallet Bitget lists as the attacker’s, sent it 23,613 TRX ($7,952), which it swapped on SunSwap into 7,825.14 USDD at 18:36. At 13:32 UTC on 3 October it swapped 5,000 USDD into 5,000 USDT and paid 4,552 USDT to TKGDKxZm…, the address it paid 4,545 USDT on 29 September. That address receives USDT from many senders, several of them paying exactly 4,552 USDT, and forwards round sums: 50,000, 14,000, 16,000 and 29,000 USDT to TWVcbSL1… on 2 and 3 October. Tether’s USDT contract, read at 15:42 UTC on 3 October, shows TYjFB3sT… free to send USDT.

Twenty-one wallets paid for the attacker’s Chainflip swaps

Chainflip’s public swap records show where each swap’s money came from as well as where it went. Twenty-one wallets on TRON, Ethereum, Arbitrum and Solana each sent their own deposit into Chainflip swaps between 25 and 29 September, named themselves as the refund address, and had the Bitcoin paid to wallets Bitget lists as the attacker’s. Three public records prove each one: the deposit, Chainflip’s swap record and the Bitcoin payout. Bitget’s tracker follows money forward from the theft, and these wallets sit one step before the Bitcoin payouts it follows. All 21 sat outside its list at 15:49 UTC on 2 October, when all were empty or held dust, and all 21 were still outside the list at 18:17 UTC on 5 October.

Swap amounts and payouts from Chainflip's swap records, with every payout confirmed on the Bitcoin chain. The dollar total uses Chainlink's BTC/USD of $85,546.69 (14:55 UTC on 2 October).

Where their money came from. Nine of the ten Ethereum wallets that swapped ETH were each filled by about ten single-use relay wallets that had just received ETH through Stargate’s bridge, the route the attacker used to move ETH to Arbitrum and back. BRGhGzzy… was also the refund address on a second swap, of 2,114 SOL sent from another wallet; the table counts only its own 1,268 SOL deposit.

Addresses beyond Bitget’s tracker

At 18:17 UTC on 5 October, Bitget’s tracker listed 4,940 addresses. The wallets traced on this page that sat outside that list, each with its balance at the stated read:

Bitget’s list has taken in many of the addresses this page traced earlier, among them the 27 and 28 September Unit payouts, the Chainflip sweep wallets of 29 September and the 26 September coinjoin exit bc1qnrhu8fc….

Bitget listed $10.2 million untraced on 28 September

At 04:26 UTC on 28 September, Bitget’s tracker put $10,202,565 of the stolen funds outside its own count: $6,454,683 “analysing”, $2,720,602 in flight, $686,870 at services and $340,411 in a coinjoin. The figure was $7.79 million at 03:34 UTC and $8.13 million at 03:51; what moved it was the ETH streaming through THORChain, which the tracker counts as in flight until the Bitcoin lands.

In flight included the ETH streaming through THORChain and the 74,800 XRP swap for ETH on Base at this 28 September snapshot.

At services records deposits into third-party custody. Shared wallet balances show where a service received funds; order records are needed to establish outstanding payouts. The following states were observed around 04:26 UTC on 28 September:

Bitget’s “NEAR Intents payout” address, bc1q05x2asa…, held 3.19 BTC at that snapshot, which came from Chainflip’s vault at 16:16 UTC on 25 September, 20 minutes before the 173,819 XRP reached NEAR Intents, so that Bitcoin payment cannot be the payout for the later XRP deposit. The four XRP orders were separately recorded as processing at the snapshot; their custody balance alone cannot establish whether other payouts occurred.

The coinjoin is round 46186ae8 on 25 September, traced out on 27 September: 4.03 BTC from two listed addresses, 4.63 BTC counting a third that Bitget also lists. Of the consolidations that gathered it, 2.01 BTC sat at bc1q6h85fsp… and 1.88 BTC at bc1qtzwpk7k…, both on Bitget’s list and both still unspent at 21:30 UTC on 5 October, and 2.00 BTC went through THORChain to TRON as 168,175.86 USDT and out through the OTC account TJvUHtZve1… in 13 transfers by 14:22 UTC on 26 September.

“Analysing” was the tracker’s residual after its other accounting categories. Its $3.78 million fees-and-losses line was last reconciled on 25 September. Later fees, slippage, price differences and transfers still being traced could affect the residual; the public ledger did not assign each difference to a particular transaction.

By 17:56 UTC Bitget’s untraced figure stood at $17.44 million: $5.07 million in flight, $8.84 million in its “analysing” residual, $2.84 million in coinjoins, up from $340,000 in the morning as its tracker took in more rounds, and $686,620 at services.

Bitget’s ledger at 13:46 UTC on 6 October

At 13:46 UTC on 6 October, Bitget’s tracker counted $343.84 million held and $39.08 million untraced, using its fixed valuation rates. Against its 18:17 UTC reading of 5 October, the held line fell by $1.69 million and the untraced line by $0.78 million. The mixer category now carries $32.71 million, alongside $5.03 million at services and $1.33 million in swaps still in flight; the $2.37 million adjustment Bitget had labelled as under analysis has cleared, and its fees-and-losses line rose to $4.34 million. Its holdings included 4,033.45 BTC ($341.06 million) and $607,478 in stablecoins. Its public address list contained 4,981 addresses, 41 more than on 5 October, among them the exchange withdrawal address that fed the morning’s swap and Maya Protocol’s Bitcoin vault, and its reviewed list stayed at 210. Bitget’s own event feed logged both Maya deposits with the memo naming the swap wallet t1f4d9KVnE…, and the list carries the Maya vault and the exchange withdrawal address that fed the swap.

The displayed rows are rounded independently. The 5 October reading is kept under earlier balance snapshots.

Circle froze a further 267,364.40 USDC at 15:29:59 UTC on 30 September, at 0xec13dfd0…, a stalled Chainflip channel holding incident-linked funds. The blacklist transaction brings the observed frozen amount to about $606,596, combining this USDC with Bitget’s existing $339,232 frozen figure. Frozen assets are a subset of the tracked funds already accounted for in the ledger above.

Stablecoin issuers froze about $606,596

Circle blacklisted 0xec13dfd08258e4e6d6532e3637b7cd223f9d691f at 15:29:59 UTC on 30 September, freezing 267,364.399306 USDC held in a stalled Chainflip channel. The Ethereum USDC contract recorded the address in its Blacklisted event, and the balance remained there at our 1 October check. Bitget classifies the channel as a service holding funds sent on the wrong network and marked it frozen in its 14:07 UTC snapshot on 1 October.

Together with the $339,231.54 already recorded as frozen in Bitget’s ledger, this brings the observed frozen amount to about $606,596. This measures funds held under issuer restrictions; recovery requires a further step. Tether also blacklisted two listed TRON wallets at 16:47 UTC on 2 October; both held USDD, so the frozen total stands, and the detail is in the TRON section. The earlier freezes are listed below.

The earlier freezes took place on 25 September

Tether and Circle have frozen stablecoins on two addresses in Bitget’s list, and both token contracts still reported the addresses as blacklisted at 00:31 UTC on 27 September.

0x9acc8434… is the TRON money’s landing address on Ethereum, where the frozen USDT is the THORChain refund described above. 0xe07bd590… also held 170.47 ETH outside the freeze, and moved that ETH out on 26 September, as described in the bridge and collector route. The freezes hold the stablecoins in place; recovering them is a separate step for the issuers.

At 15:05 UTC on 29 September, Bitget’s tracker marked $308,796 in stablecoins as potentially freezable, a moving category separate from the $339,232 already frozen above. The largest listed balance was 267,364.40 USDC at 0xec13dfd0…, which had held it since 05:57 UTC and was not blacklisted at the afternoon check. The 281,661.96 USDC seen at 0x04065ccf… at 03:12 had already moved on. A potential freeze depends on issuer action before the current balance moves.

Bitget’s phased withdrawal plan was completed on 2 October

Bitget announced at 08:00 UTC on 2 October that withdrawals for tokens other than BTC, ETH and USDT, and its fiat and C2C services, had resumed, and that “Bitget’s previously announced phased resumption plan for token withdrawals and related services has been fully completed”. A second notice set on-chain trading to resume at 08:00 UTC the same day. The phased schedule, as Bitget published it:

Bitget says each network reopened after additional security checks, with the same schedule for all users. Its restoration announcement says users need take no advance action and that trading and deposits continued throughout.

Which prices we used

Bitget’s tracker uses fixed rates for its holdings ledger. The 21:00 UTC update of 10 October uses Chainlink’s BTC/USD of $82,958.94 (18:31 UTC); USDT, USDD and DAI count at $1. The 11:00 UTC update of 10 October uses Chainlink’s BTC/USD of $82,744.23 (08:27 UTC); USDT and USDD count at $1. The 16:50 UTC update of 9 October uses Chainlink’s BTC/USD of $82,835.41 (15:21 UTC); USDT and USDD count at $1. The 11:00 UTC update of 9 October uses Chainlink’s BTC/USD of $82,509.46 (10:58 UTC) and ETH/USD of $2,492.31 (10:38 UTC), with CoinGecko’s quotes of ALGO $0.116702 (11:01 UTC) and TRX $0.332273 (11:11 UTC); USDT and USDD count at $1. The 8 October update uses Chainlink’s BTC/USD of $82,320.80 (12:43 UTC) and ETH/USD of $2,521.20 (13:51 UTC), with CoinGecko’s 13:21 UTC quote of ZEC $1,219.69. The 6 October update uses Chainlink’s BTC/USD of $86,106.69 (13:09 UTC) and ETH/USD of $2,712.74 (13:12 UTC), with CoinGecko’s 13:29 UTC quotes of ZEC $1,377.06, TRX $0.335453, USDD $0.999148 and USDT $0.99991. The 5 October update uses Chainlink’s BTC/USD of $85,315.19 (17:35 UTC) and ETH/USD of $2,698.46 (17:16 UTC), with CoinGecko’s 18:11 UTC quotes of ZEC $1,320.54, TRX $0.336558, USDD $0.999228 and USDT $0.999958. The afternoon 4 October update uses Chainlink’s BTC/USD of $85,128.07 (12:55 UTC) and ETH/USD of $2,697.41 (13:16 UTC). CoinGecko’s 13:35 UTC quotes are ZEC $1,328.81, TRX $0.336012, USDD $0.999025 and USDT $0.999866. The early 4 October Zcash-route update uses CoinGecko’s 23:18 UTC prices from 3 October: BTC $84,748, ETH $2,686.36 and ZEC $1,300.30. Other 3 October route figures use Chainlink’s BTC/USD of $84,800.47 (14:49 UTC) and ETH/USD of $2,680.33 (15:08 UTC on 3 October), with CoinGecko’s ZEC, TRX and USDD prices at 15:43 UTC. The 30 September Bitcoin recipient value uses the tracker’s BTC rate of $84,558.29. Earlier Bitcoin and ETH route values use the Chainlink prices below. Historical route sections retain the prices stated below or alongside each calculation.

Stablecoins in the 27 September figures are counted at $1. Figures from the theft itself keep the prices stated beside them.

* Dollar values are approximate. Prices, gas fees, service fees and swap slippage change the value measured at each step; a small dollar difference alone does not establish a missing transfer. The wallet balances and transaction links above, rather than a dollar-to-dollar match, are the basis for the traced routes.

Earlier balance snapshots

Earlier snapshots, 28 September to 5 October

These are Bitget’s earlier ledger readings and our earlier balance checks, kept for the record. Each is a dated snapshot of the same money, so none of them adds to the figures above. The 8,582.56 ZEC they show at the main Zcash wallet is the balance it held from 30 September until it emptied into the shielded pool on 5 October.

Bitget’s ledger, 18:17 UTC on 5 October

At 18:17 UTC on 5 October, Bitget’s tracker counted $345.53 million held and $39.86 million untraced, using its fixed valuation rates. Against its 13:36 UTC reading of 4 October, the untraced line grew by $13.89 million as the drained Zcash and the morning’s coinjoins moved into its mixer category, which then carried $34.76 million, alongside $6.13 million at services and $1.33 million in swaps still in flight, less a $2.37 million adjustment Bitget labelled as under analysis. Its holdings included 4,038.45 BTC ($341.48 million), $1.87 million in stablecoins, 10,108,920 ALGO ($1.14 million) and 370.45 ETH ($1.00 million); the listed Zcash wallets held under 0.002 ZEC after the day’s shieldings. Its public address list contained 4,940 addresses, 47 more than on 4 October, including the four Zcash intermediaries and the four hoard parcels described above.

Where Bitget placed the original $387.5 million	Amount at 18:17 UTC, 5 October
Held in tracked wallets, including frozen funds	$345.53m
Reached exchanges	$0.21m
Fees and losses	$1.90m
Untraced in Bitget’s ledger	$39.86m
Original amount stolen	$387.50m

The displayed rows are rounded independently. The main Zcash wallet, which held 8,582.56 ZEC on 4 October, held 0.00067931 ZEC at 18:13 UTC on 5 October; the 5 October transfers moved that balance into the shielded pool, where Bitget’s ledger counts it as untraced.

Bitget’s ledger, 13:36 UTC on 4 October

At 13:36 UTC on 4 October, Bitget’s tracker counted $358.46 million held and $25.97 million untraced, using its fixed valuation rates. Its holdings included 4,017.41 BTC ($339.71 million), 8,582.56 ZEC ($13.32 million), $3.39 million in stablecoins, 10,110,000 ALGO ($1.14 million) and 324.46 ETH ($0.87 million). Its public address list contained 4,893 addresses.

Where Bitget placed the original $387.5 million	Amount at 13:36 UTC, 4 October
Held in tracked wallets, including frozen funds	$358.46m
Reached exchanges	$0.21m
Fees and losses	$2.85m
Untraced in Bitget’s ledger	$25.97m
Original amount stolen	$387.50m

The displayed rows are rounded independently. Of the untraced line, Bitget placed $21.66 million in coinjoins and the Zcash private pool, $2.98 million at services and $1.33 million in swaps still in flight.

The main Zcash wallet held 8,582.56097993 ZEC, quoted at $11.40 million using CoinGecko’s $1,328.81 price at 13:35 UTC on 4 October. Bitget values that same holding at $13.32 million in its fixed-rate ledger. Both figures describe the same coins. The wallet’s last transaction at that read was at 23:50 UTC on 30 September.

Bitget’s ledger, 15:17 UTC on 3 October

At 15:17 UTC on 3 October, Bitget’s tracker listed 4,017.41 BTC ($339.71 million), 8,582.56 ZEC ($13.32 million), $4.30 million in stablecoins, 10,110,000 ALGO ($1.14 million) and 324.70 ETH ($0.87 million), with 4,881 addresses on its list. It counted $359.37 million held and $25.15 million untraced in its ledger, using its fixed valuation rates.

Where Bitget placed the original $387.5 million	Amount at 15:17 UTC, 3 October
Held in tracked wallets, including frozen funds	$359.37m
Reached exchanges	$0.21m
Fees and losses	$2.76m
Untraced in Bitget’s ledger	$25.15m
Original amount stolen	$387.50m

The displayed rows are rounded independently.

Of the untraced line, Bitget puts $21.66 million in coinjoins and the Zcash private pool, $2.16 million at services and $1.33 million in swaps still in flight. $564,781 of the in-flight line, at Bitget’s rates, is two Chainflip ETH deposits sent on the wrong network, described in the TRON section.

The main Zcash wallet held 8,582.56097993 ZEC ($11.14 million at CoinGecko’s $1,298.19 a coin) at 15:43 UTC on 3 October, and last moved at 23:50 UTC on 30 September. It is the only transparent Zcash balance left in Bitget’s count: the 1,004.02412847 ZEC that stood at t1gNZpuH… went into the Ironwood shielded pool at 14:55 UTC on 3 October, described in the Zcash section.

Three of the Bitcoin consolidation wallets that held 28.79, 5.41 and 1.71 BTC on 29 September emptied on 30 September. Their next recipients are addresses Bitget attributes to the attacker. These are movements of funds already counted in the dated holdings figures.

Bitget’s ledger, 15:49 UTC on 2 October

At 15:49 UTC on 2 October, Bitget’s tracker listed 4,018.12 BTC ($339.77 million), 9,586.59 ZEC ($14.88 million), $4.61 million in stablecoins and 324.59 ETH ($0.87 million) across 4,852 addresses. It counted $361.31 million held and $22.50 million untraced in its ledger, using its fixed valuation rates.

Where Bitget placed the original $387.5 million	Amount at 15:49 UTC, 2 October
Held in tracked wallets, including frozen funds	$361.31m
Reached exchanges	$0.21m
Fees and losses	$3.47m
Untraced in Bitget’s ledger	$22.50m
Original amount stolen	$387.50m

Of the untraced line, Bitget puts $19.99 million in coinjoins and the Zcash private pool, $1.74 million at services and $0.77 million in swaps still in flight.

The main Zcash wallet held 8,582.56097993 ZEC ($11.71 million at CoinGecko’s $1,364.85 a coin) at 15:49 UTC on 2 October, unchanged since 23:50 UTC on 30 September. A further 1,004.02412847 ZEC ($1.37 million) remained at known attacker wallet t1gNZpuH…. Those two balances account for the tracker’s Zcash total. Five late transfers moved another 3,007.33 ZEC from the main wallet between 23:22 and 23:50 UTC on 30 September; the transaction table follows them into transparent balances and shielding.

Bitget’s ledger, 14:07 UTC on 1 October

At 14:07 UTC on 1 October, Bitget’s tracker listed 4,007.86 BTC ($338.90 million), 9,586.59 ZEC ($14.88 million) and 327.77 ETH ($0.88 million). It counted $361.17 million held and $22.32 million untraced in its ledger, using its fixed valuation rates.

Where Bitget placed the original $387.5 million	Amount at 14:07 UTC, 1 October
Held in tracked wallets, including frozen funds	$361.17m
Reached exchanges	$0.21m
Fees and losses	$3.79m
Untraced in Bitget’s ledger	$22.32m
Original amount stolen	$387.50m

At the earlier 22:00 UTC check on 29 September, Bitget labelled the 267,364.40 USDC at 0xec13dfd0… and the 159.98 ETH at 0x35b32736… as stalled Chainflip deposits sent on the wrong network. These were service-held assets in its accounting. Circle’s subsequent freeze is detailed in the stablecoin section.

The earlier recipient check, 17:21 UTC on 29 September

The 17:21 UTC check found 7.28 BTC still unspent across nine unlisted recipients and confirmed 258,398 USDT previously paid into two connected TRON accounts. The Bitcoin recipients include inferred privacy routes and possible third-party payments.

Finding at the stated check	Amount	What the figure measures
One unspent receipt from a Bitget-listed wallet	3.82288473 BTC, about $318,000	Balance at bc1qztxfsc…
Five recipients of the inferred Zcash exit route	3.41116348 BTC, about $284,000	Balances at 17:21 after three earlier payouts were consolidated
Three small recipient outputs	0.04462651 BTC, about $3,700	Two likely change outputs and one possible payment to a third party
Unspent Bitcoin across those nine recipients	7.27867472 BTC, about $605,000	A dated subtotal that includes inferred routes and possible third-party payments
Two payments into connected TRON accounts	258,398 USDT	Historical receipts; the receiving accounts also handle other funds
Likely exchange-deposit route	1.19667522 BTC, about $99,500	A payment later swept into a high-volume wallet
Fifteen further attacker-fed coinjoin rounds	19.68722259 BTC, about $1.64m	Gross inputs to rounds omitted from the tracker’s coinjoin inventory

The last three rows describe movements through services and mixing transactions. Repeated spends can move the same coins through several rounds, and service balances combine funds from different senders. Each row is kept separate from the unspent Bitcoin subtotal. The totals above remain dated snapshots: the later tracker holdings and these earlier route balances have different cut-off times.

Bitget’s earlier ledger, 15:05 UTC on 29 September

Bitget’s tracker, updated at 15:05 UTC on 29 September, listed 3,356.99808 BTC, 3,597.958601 ETH and 18,669.978729 ZEC in attacker holdings. Its four accounting lines still reconcile to the original $387.5m at the tracker’s fixed prices:

What Bitget listed at 15:05 UTC	Amount
Held in tracked wallets, including frozen funds	$324.33m
Reached exchanges	$0.21m
Fees and losses last reconciled on 25 September	$3.78m
Untraced in Bitget’s ledger	$59.18m
Original amount stolen	$387.50m

Of the untraced line, $7.28m was in flight through swaps, $3.94m in coinjoins, $0.69m at services, and $47.27m was labelled “analysing”. The last category is a calculation without itemised destination wallets. From 02:58 to 15:05 UTC, the tracker’s ETH count fell by about 25,716 ETH while its Bitcoin count rose by 442.23 BTC. At Bitget’s fixed rates, the reduction in ETH value exceeds the added Bitcoin value by about $31.77m. That comparison does not locate the difference: swaps in progress, other assets, unlisted hops, fees and price changes can all affect it. We are continuing to follow those routes rather than treating the residual as traced money.

Between 03:25 and 14:44 UTC, hoard wallet 2 and the two remaining 10,000 ETH wallets sent 26,043.63 ETH in 183 transfers to 18 hop wallets. Hoard wallet 2 and 0xfd5ebe91… were effectively empty at our 15:03 UTC chain check; 0xed5a394a… still held 635.33 ETH. Those are selected hoard balances, not the full ETH position. The hop-wallet routes are detailed in the ETH section.

Bitget’s earlier tracker snapshot, 04:26 UTC on 29 September

Bitget’s tracker, read at 04:26 UTC on 29 September, attributed 2,935.13 BTC, 29,209.23 ETH and 18,669.98 ZEC to the attacker. Its $357.81m holdings figure includes about $339,232 already frozen; that frozen amount is a part of holdings, not an extra line to add. Bitget also counted about $165,087 at exchanges, $3.78m in fees and losses as last reconciled on 25 September, and $25.74m untraced. These four lines reconcile to the original $387.5m at the tracker’s own fixed prices.

What Bitget listed at 04:26 UTC	Amount
Held in tracked wallets, including frozen funds	$357.81m
Reached exchanges	$0.17m
Fees and losses last reconciled on 25 September	$3.78m
Untraced in Bitget’s ledger	$25.74m
Original amount stolen	$387.50m

The untraced line comprises about $3.44m in flight through swaps, $2.84m in coinjoins, $0.69m at services and $18.77m labelled “analysing”. That last figure is a residual, not a wallet balance. Our 21 Bitcoin wallets and the four later coinjoin rounds identify routes that Bitget’s list had not yet itemised at those dated checks; their approximate dollar values must not be added to the original theft or counted twice when Bitget updates its tracker. The remaining residual may include further transfers, fees, slippage and price differences. We continue to examine swaps, bridges, privacy pools and newly created wallets; the public data does not yet establish a destination for every dollar.

The 01:14 UTC Ethereum transaction moved 10,000 ETH from 0xa6bfd7fc… into hoard wallet 2. Two other hoard wallets, 0xfd5ebe91… and 0xed5a394a…, still held 10,000 ETH each at the 04:26 tracker reading. Hoard wallet 2 then held 6,510.57 ETH; the separate collector 0x54c541a3… held 714.03 ETH. These are selected wallets, not the complete ETH total.

At the earlier 01:06 UTC reading, three 10,000 ETH wallets had still been untouched and hoard wallet 2 held 1,057.69 ETH. The previous, broader ETH count follows as a dated historical snapshot; its hop-wallet balances should not be combined with later balances because funds continued moving.

ETH location, 23:30 to 23:37 UTC	Amount
Three untouched hoard wallets	30,000 ETH
Hoard wallet 2	2,476 ETH
About 31 hop wallets	About 2,100 ETH
Approximate ETH total after possible overlap	34,100 to 34,600 ETH

Up to 509 ETH may appear twice among the hop-wallet readings as transfers were in progress. The Zcash holding was still 18,669.98 ZEC. These later ETH observations and Bitget’s earlier BTC count have different cut-off times, so the article keeps them as separate snapshots. At the late-evening price of $2,684.81 per ETH, the approximate ETH holding was worth $91.5m to $92.8m. Three other hoard wallets had paid 4,326.46 ETH, 4,596.47 ETH and 10,000 ETH into hoard wallet 2 at 11:52, 14:28 and 18:55 UTC; the last transfer came after Bitget’s 18:36 reading. The 18:55 transfer shows the later consolidation.

Bitget’s earlier holdings snapshot, 17:55 UTC on 28 September

Bitget’s historical tracker record valued its attributed holdings at $366,217,643.11 at 17:55:28 UTC on 28 September. A separate Bitcoin observation was made at 18:05 UTC. Both use the tracker’s fixed valuation rates, making the dollar amounts comparable across those two earlier snapshots.

Holding	Amount	Value
Bitcoin on Bitget’s tracker	2,534.99 BTC	$214.35m
ETH on Bitget’s tracker	About 44,172.02 ETH	$118.81m
Zcash	18,669.98 ZEC	$28.98m
Stablecoins, including frozen funds		$2.91m
ALGO	10,110,000 ALGO	$1.14m
XRP, BNB, TRX, AVAX and SOL		$0.02m
Bitget’s holdings subtotal, 17:55:28 UTC		$366.22m
Bitcoin beyond Bitget’s map, 24 addresses at 18:05 UTC	30.57679036 BTC	$2.59m
Combined attributed holdings		$368.80m

The additional Bitcoin includes coinjoin and Zcash links inferred from the Bitcoin and Zcash evidence. The combined figure also spans two observation times. Around 17:56 UTC the tracker separately reported about $5.07m in pending swaps. The 166,000 USDT received by the possible TRON desk establishes a payment into service custody; the desk’s settlement records are needed to establish any remaining entitlement. Both are excluded from the holdings total.

The tracker uses fixed rates of BTC $84,558.29, ETH $2,689.75, ZEC $1,552.19 and ALGO $0.1127. Its historical asset values sum to $366,217,643.11. The additional 30.57679036 BTC is valued at $2,585,521.11 using the same BTC rate. ETH quantity is derived from the historical dollar value and the tracker's rate. These are dated valuations, rather than current market prices.

Update, 10 October, 11:00 UTC: 85.59 BTC of gathered coins went through THORChain to TRON, and $8.3 million went round two new pools

• Four addresses on Bitget’s list gathered 85.59 BTC ($7.08 million) of coinjoin outputs between 15:03 UTC on 9 October and 01:01 UTC on 10 October, and sent all of it through THORChain. bc1qrdtunr0…, bc1qvtz3fky…, bc1qfyx9upd… and bc1qtrezusj…, each dated by Bitget’s tracker to its first gathering, took outputs of the rounds the split coins went through and of the rounds those outputs went on to, among them 3.23 BTC ($266,861) of the 17:46 UTC round that the seventh 3.87 BTC coin entered, and made 34 THORChain deposits of 0.96 to 3.29 BTC ($79,000 to $272,000) each between 16:01 UTC on 9 October and 03:11 UTC on 10 October. 1.56 BTC ($128,919) of it went into Chainflip deposit channels first and came back within 24 minutes. The deposits.
• THORChain paid the swaps out as 7,435,927.82 USDT ($7.44 million) to five Ethereum wallets on Bitget’s list, and 7,434,727.82 USDT of it went straight into the USDT0 bridge to TRON. Four of the wallets, 0xbafA3F1E…, 0xeaf8f7dA…, 0x98666580… and 0x741d5c8B…, received 33 payouts of 78,494.93 to 269,028.28 USDT between 16:23 UTC on 9 October and 03:54 UTC on 10 October and sent all but 1,200 USDT of it into the bridge within 40 minutes. The fifth took the largest swap: at 01:48:49 UTC Chainflip account 1689’s refund address sent 7.92572492 BTC ($655,808) of gathered coins into THORChain, which paid 649,945.75 USDT to 0x31E572a4… at 02:55:35 UTC; it passed the USDT to 0xbafA3F1E… five minutes later, and that went into the bridge at 03:02:23 UTC. Six more deposits were paid out as USDT on TRON itself: 2.55 BTC ($210,998) from bc1qvtz3fky… became 208,425.83 USDT at TP7gsCw6…, which passed it to a collector 13 minutes later, and the refund address sent five deposits of 1.0, 1.96717795, 0.97238658, 4.8 and 0.54788326 BTC (9.29 BTC, $768,483) between 23:41 UTC on 9 October and 00:59 UTC on 10 October for USDT at TANvASa8…; THORChain returned most of the first two (2.91 BTC, $240,953), which went back in as the third and fourth, and paid 522,962.23 USDT for the 6.38 BTC ($527,530) it kept; that became USDD and reached the collector TN7P51Fc… at 02:36:21 UTC.
• On TRON the bridged USDT and the direct THORChain payouts, 8.16 million USDT in all, became USDD, then USDT again, and went round two new pools: 8,327,678.46 USDT ($8.33 million) by 08:00 UTC. The USDT0 contract delivered 7,432,497.40 USDT to four collector wallets, and THORChain’s TRON payouts added 731,388.07 USDT. Three collectors swapped their USDT to USDD and paid TMS87muv… 5,000,903.40 USDD between 02:07 and 02:09 UTC; the fourth, TN7P51Fc…, paid TQkRWdr7… 3,162,982.06 USDD at 04:08:57 UTC, and 163,793 USDD more reached TQkRWdr7… from TQX7j94R…, a THORChain payout for a 2.0 BTC deposit of coinjoin outputs. The USDD was split, swapped back to USDT and spread over 113 fresh wallets holding 41,827 to 96,362 USDT each, and every one of them lent its USDT to JustLend and put the lending tokens into one of two new SunSwap pairs against two new tokens both named JWYT: 67 wallets into TJCAgsPK… (5,000,903.40 USDT, 03:31 to 05:42 UTC) and 46 into TF3Q4dxX… (3,326,775.06 USDT, 06:54 to 08:00 UTC). The two pools.
• The seventh 3.87 BTC coin went into a 228-input round at 17:46 UTC on 9 October, and 3.23 BTC ($266,935) of that round’s outputs was gathered into the four listed addresses and the refund address by 01:00 UTC. The coin is one of the seven 3.87420489 BTC outputs of the 16:00 UTC round of 8 October that took ten of the attacker’s split coins. Of the 341 outputs of the round it entered, 258 had been spent by 09:14 UTC on 10 October: 24.69 BTC ($2.04 million) into further rounds, 193 of those outputs that evening and 19 the next morning; 3.23 BTC ($266,935) into the gathering addresses; and 0.87 BTC ($72,390) to other addresses. The other 83 outputs, 1.94 BTC ($160,153), were unspent. The round.
• Balances at 09:25 UTC. bc1q3vycf72pttcw… held 20.962 BTC ($1.73 million), and Bitget’s ledger counted $335.06 million held and $46.28 million untraced.

Dollar quotes use the dated prices.

Update, 9 October, 16:50 UTC: the TRON pool’s creator cashed out $807,619, and Chainflip sent back 2.97 BTC

• The wallet that created the JWYT trading pool on TRON, which the attacker’s $1.65 million went through that morning, cashed out $807,619 at 12:16 UTC on 9 October. TSK8Tu1h… had put 769,210 USDT ($769,210) into its own pool as liquidity at 09:20 and 10:16 UTC. At 12:15 UTC it withdrew its stake, then sold JWYT into the pool for nearly all the lending tokens left in it, and at 12:16 UTC it redeemed them at JustLend for 807,618.74 USDT ($807,619), which it paid on 30 seconds later. The route out of the pool.
• The money that came out of the pool went through wallets set up before the attacker’s money went in. At 09:23 UTC, 18 minutes before the attacker’s USDD reached TNT1nVbj…, the wallet that fed the pool, TAyqWsTw… activated ten fresh wallets. From 09:50 UTC they collected the USDT redeemed out of the pool, and by 12:01 UTC they had paid 3,743,592.89 USDT ($3.74 million) to TAyqWsTw…. It sent $1.63 million of it round the pool again through 20 more wallets, and by 13:48 UTC the rest, with the creator’s 807,618.74 USDT, 2,916,323.63 USDT ($2.92 million) in all, had passed through five wallets activated between 09:42 and 09:44 UTC, before the money went into the pool at 09:46. The route.
• Chainflip account 1689, whose refund address took the first gathering that morning, pulled 2.97 BTC more out of the coinjoin rounds that afternoon, and Chainflip sent every deposit back. Between 14:38 and 15:00 UTC, three transactions gathered 35 more outputs of the rounds the split coins and their outputs went through, 2.9675032 BTC ($245,814), straight into the Bitcoin refund address that liquidity account 1689 had registered with Chainflip at 14:27 UTC. The coins went into the account’s Bitcoin deposit channel five times between 14:38 and 15:25 UTC, and Chainflip returned every deposit by 15:40 UTC. At 16:32 UTC the account sent the 2.97 BTC to the channel a sixth time, in a payment still waiting for a block at 16:48 UTC. That the gathered coins are the attacker’s is supported. The deposits.
• Balances at 16:48 UTC. bc1q3vycf72pttcw…, the Bitcoin address that took the mixed 11.32 BTC on 8 October, held 20.962 BTC ($1.74 million), and Bitget’s ledger counted $336.00 million held and $46.86 million untraced.

Dollar quotes use the dated prices.

Update, 9 October, 11:00 UTC: Bitcoin from coinjoin rounds the attacker used became $1.65 million on TRON

• Bitcoin gathered from the coinjoin rounds the attacker used on 8 October was swapped for $1.65 million on TRON on 9 October. From 01:40 UTC, transactions gathered outputs of the rounds the split coins had gone through, and between 04:47 and 07:56 UTC ten swaps sent 20.24 BTC ($1.67 million) through THORChain to six fresh TRON addresses, which received 1,651,661.98 USDT. By 09:22 UTC the whole sum sat in one wallet as USDD, a TRON stablecoin. A coinjoin hides who owns each output, so that this is the attacker’s money is supported. Bitget’s tracker lists the two main gathering addresses and that wallet as the attacker’s, and Chainflip’s own record listed the first gathering address that morning as the Bitcoin refund address of the liquidity account Bitget’s tracker calls LP 1689, whose earlier refund address received the Bitcoin of a 30 September Zcash swap. The swaps.
• At 09:41 UTC the $1.65 million moved again, through JustLend and a trading pool opened that morning. A wallet activated three minutes earlier took the whole USDD balance, swapped it back to USDT and paid it to 20 fresh wallets. Each lent its USDT to JustLend and traded the lending tokens for JWYT, a token created at 09:03 UTC, in a pool its creator had opened at 09:17. The wallet that created JWYT paid for both sides: it sent the first funds to the wallet that received the $1.65 million, three minutes before the money arrived, and, through one more wallet, the gas of a wallet that drew money back out of the pool. The pool.
• At least five of seven 3.87 BTC coinjoin outputs trace back to the attacker’s coins. A round mined at 16:00 UTC on 8 October took ten of the split coins, 33.20 BTC ($2.74 million), and paid seven outputs of exactly 3.87420489 BTC ($319,659 each). Every other input of the round came to 10.77 BTC ($888,697), enough to pay for two of them, so at least five came from the wallet that put in the split coins: supported as the attacker’s. The round.
• Two payouts of the 7 October capitals-typed swaps were spent together at 00:55 UTC on 9 October, which shows one key holder received both. The combined 0.52941967 BTC ($43,682) went into a 22-input coinjoin at 05:23 UTC; the run’s other 31 payouts still held 12.02 BTC ($991,911) at 11:00 UTC. The swaps.
• On 8 October, $205,140 collected on a new TRON wallet went to the attacker’s Bitcoin hub. A new TRON wallet sent 205,139.65 USDT to Ethereum, THORChain swapped it for 2.47854669 BTC ($204,504), and 1.84 BTC ($151,817) went to bc1q3vycf72pttcw…, the address that took the 11.32 BTC that morning. The route.
• The attacker put 9.5 ETH ($23,677) into Tornado Cash, in 14 deposits on 30 September and 4 October from a wallet Bitget lists as the attacker’s. The deposits.
• The last 10.11 million ALGO ($1.18 million) left the attacker’s ALGO receiver on 8 October, and one relay address held 6.33 million ALGO ($739,180) at 11:00 UTC on 9 October. The NFT-funded wallet still held 81.30 ETH ($202,637), and Bitget’s ledger counted $336.00 million held and $46.86 million untraced at 11:01 UTC. The ALGO.

Dollar quotes use the dated prices.

Update, 8 October, 13:30 UTC: mixed coins matching 11.32 BTC reached a listed wallet, and 161.83 BTC began to move

• Two Bitget-listed addresses put 11.3231789 BTC ($932,133) into two coinjoin rounds mined at 02:52 UTC on 8 October, and at 07:01 UTC one transaction gathered 40 outputs of six later rounds, 11.32310975 BTC, 6,915 satoshis ($5.69) short of what went in. The gathered coins went on through two fresh addresses to bc1q3vycf72pttcw…, an address Bitget lists as the attacker’s, which held 19.122 BTC ($1.57 million) at 13:10 UTC. Each step after the gathering is a spent output; that the gathered coins are the coins that went in is supported. The trace.
• From 08:38 UTC on 8 October, 161.83 BTC ($13.32 million) on 19 Bitget-listed attacker addresses was regrouped into twelve 10 BTC coins plus change and split into 50 fresh coins, 37 of them round amounts on Taproot addresses. At 12:42 UTC one 2.0 BTC ($164,642) coin entered a new coinjoin round, and two Taproot coins each had a 1.0 BTC piece split off. The split.
• On 7 October, between 00:34 and 06:57 UTC, 33 more Zcash-to-Bitcoin swaps with the recipient typed in capitals took 804.05 ZEC ($980,689) out of the shielded pool and paid 12.56 BTC ($1.03 million) to 33 fresh addresses. Apart from a 0.01 BTC piece that entered a coinjoin on 8 October, that Bitcoin was unspent at 13:10 UTC on 8 October. The swaps.
• The three 100 ZEC orders, 300 ZEC ($365,907) in all, were still failed at 13:10 UTC on 8 October, with nothing refunded and every deposit held by the swap service, and Bitget’s ledger counted $345.62 million held and $39.71 million untraced at 13:08 UTC.

Dollar quotes use the dated prices.

Update, 6 October, 22:30 UTC: attribution labels name HitBTC behind the round Zcash parcels and the Bitcoin that funded the 6 October swap

• The venue that took the 26 round Zcash parcels is labelled as HitBTC. Attribution labels were read on 6 October for the 187 addresses gathered in the 5 and 6 October trace. The sweep wallet t1Zzkb4eGARP… and the hot wallet t1cArVf7BgN3… carry HitBTC’s label, and all 26 parcel addresses swept on 6 October carry the label “HitBTC Deposit”. The venue now has a name and account records to ask; the depositor’s connection to the theft stays possible. The sweep and where the exits ended up.
• The hot wallet that paid 2.10 BTC ($180,956) into the 6 October swap is labelled as HitBTC’s Bitcoin hot wallet, and the KuCoin label on the 1.61 BTC ($138,507) leg is confirmed. Both coins were gathered into the listed exit receiver the next morning in one transaction with coins from two other Bitget-listed addresses, so the exchange that took the parcels on deposit also paid a withdrawal to an address Bitget now lists. The round trip.
• The labels carry Bitget’s own Zcash hot wallet as Bitget’s, as its tracker does, and the address that relayed the 100 ZEC ($137,706) exit of 6 October into it as a Bitget deposit address, which this record had read from the address’s behaviour and Bitget’s tracker leaves unlabelled. The deposit.
• Four of this trace’s addresses sit in Arkham’s “Bitget Hacker” entity, and all four are Bitget-listed wallets the case starts from: the exit receiver, the hoard, the TRON wallet TCThtz9Q… and the shielding wallet, each scored SEVERE. The entity holds 3,717 addresses and predates the theft, with history back to March 2025. The wallets this record reached by following the money onward, among them t1f4d9KVnE…, the swap group’s two largest resting coins and the TRON hub, sit in that data as plain addresses scored NONE. Arkham’s counterparty table for t1f4d9KVnE… records $5.72 million of two-way volume with one Maya Protocol vault over 34 transactions and $3.69 million paid out over eight transactions on 5 and 6 October to the shielding wallet it labels “Bitget Hacker”. Where the exits ended up.
• The Relay.link bridge solver TYVWGh8X… paid the attacker’s listed TRON wallet TCThtz9Q… its first 78.22 TRX ($26) at 08:17 UTC on 25 September, the morning after the theft, and later paid the first TRX of the 5 October run’s hub and relay. The run.

Dollar quotes use the dated prices.

Update, 6 October, 13:46 UTC: the attacker’s listed Bitcoin bought 447 ZEC back and it went into the pool

• At 08:50 UTC on 6 October the exit receiver Bitget lists as the attacker’s, bc1qh2mlug08…, gathered 9.23 BTC ($795,191), 3.71 BTC ($319,463) of it withdrawn the day before from two high-volume hot wallets, one of them labelled by Bitget as KuCoin’s, and sent 7.1 BTC ($611,357) and then 1.4 BTC ($120,549) into Maya Protocol with swap memos naming t1f4d9KVnE…, the Zcash wallet that swapped pool exits on 4 and 5 October, as the recipient. Maya refunded 1.40 BTC ($120,762), swapped the remaining 7.0975 BTC ($611,145) into 447.16 ZEC ($615,765) and paid it to t1f4d9KVnE… by 09:59 UTC; by 10:33 that wallet had paid all of it to the attacker’s listed shielding wallet, t1gNZpuHEpST…, which shielded it at 10:34. The chain and Maya’s own swap record establish the route. The key behind the listed receiver signed an order naming the wallet as the destination for its money, and the wallet handed every coin to the listed shielding wallet, so money left a listed wallet and reached a listed wallet through it in both directions: the wallet is now established as under the attacker’s control, or as a custodian acting on his instructions, and on either reading the money is his. The round trip.
• Fresh money in the shielded pool since 30 September stands between 18,581 ZEC ($25.59 million) and 19,028 ZEC ($26.20 million). The range is there because the one deposit that funded the swap mixed proceeds returning from the pool with fresh exchange withdrawals. The pool arithmetic.
• Twenty-four round Zcash parcels were one venue’s deposit addresses. Six parcels of 21 to 25 ZEC that had sat since 3 October and 18 of the twenty 20 to 50 ZEC parcels cut on 5 October were spent together at 03:44 UTC on 6 October in one 125-input transaction, 1,240.45 ZEC ($1.71 million), into a custodial sweep wallet with about 3.57 million ZEC of history. The venue can name the depositor; the depositor’s connection to the theft stays possible. The 22:30 UTC update above names the venue. The sweep.
• Ninety-five swap orders placed straight through NEAR Intents’ order API, about 30 ZEC each, put 2,619 ZEC ($3.61 million) into TRON USDT on 5 October. Ninety of the payouts were swept into one address and churned through the USDD peg module the way Bitget’s listed TRON downstream wallets do. The run is established as one operator’s, and NEAR Intents’ own order records tie that operator to five orders placed on 1 October inside the window of the attacker’s capitals run, so the operator’s connection to the theft is supported. The run.
• The three 100 ZEC orders ($137,706 each) have all failed, the third at 07:43 UTC on 7 October, with nothing refunded and every deposit still held by the swap service. The swap group’s 43.91 BTC ($3.78 million) and the hoard’s four parcels (29.53 BTC, $2.54 million) sit where they were, and the NFT-funded wallet still holds 81.34 ETH ($220,665). Bitget’s ledger counted $343.84 million held and $39.08 million untraced at 13:46 UTC, with 4,981 listed addresses. The orders, the un-mix and the ledger.

Dollar quotes use the dated prices.

Update, 5 October, 18:55 UTC: 8,582 ZEC entered the pool and 19.69 BTC came out through Maya Protocol

• The main Zcash wallet moved its whole 8,582.56 ZEC ($11.33 million) into the shielded pool between 06:32 and 12:37 UTC on 5 October. Fresh money in the pool since 30 September stood at 18,581 ZEC ($24.54 million) at this read; the 6 October update above carries the range after the round trip. The transfers and shieldings.
• A second wallet, first funded on 3 October, received 3,455 ZEC ($4.56 million) straight from the pool and 195 ZEC more through two relay addresses. It put 3,619 ZEC into Maya Protocol, which swapped 1,320 ZEC after refunds and paid 19.69 BTC ($1.68 million) to an address Bitget lists as the attacker’s exit receiver, and it paid 2,319 ZEC ($3.06 million) into the attacker’s listed shielding wallet. The chain establishes the route; the wallet’s connection to the theft was supported at this read, and the 6 October round trip above establishes it. The route.
• Ten of the twelve Bitcoin addresses of the Zcash-swap group, the wallet whose 49 swaps turned the attacker’s shielded Zcash into Bitcoin on 30 September and 1 October, moved 14.48 BTC ($1.24 million) between 03:38 and 07:50 UTC: 2.97 BTC into three coinjoin rounds, 6.5 BTC to a fresh address, and the rest into a 33-input spend that recombined 3.0 BTC ($256,000) of the mixed outputs with the group’s own coins. The group holds 43.91 BTC ($3.75 million) established as one wallet; its attribution to the theft remains supported. The un-mix.
• The listed Bitcoin hoard paid 29.53 BTC ($2.52 million) into four parcels, which Bitget listed within the hour. The parcels.
• Bitget’s ledger counted $345.53 million held and $39.86 million untraced at 18:17 UTC, and the NFT-funded wallet still held 81.34 ETH ($219,503). The ledger and the wallet.

Dollar quotes use the dated prices.

Update, 4 October, 16:57 UTC: TRON payments reached a collection address

• Two payments totalling 281.2 USDT (about $281) reached a collection address from the NFT-funded wallet’s TRON recipient. They remained there at the 15:43 UTC check. The payments and the recipient’s older transfers.
• Bitget-listed TRON wallets paid about $851,000 to six addresses labelled as OTC desks or suspected desks. The 4 October payments.
• The Zcash-swap group retained 43.0 BTC ($3.66 million), and the NFT-funded wallet held 81.34 ETH ($219,418). Attribution of these routes to the theft remains supported. The balance checks use the dated prices below.

Update, 4 October, 15:38 UTC: NFT-linked funds reached TRON

The new public transactions show small bridge payments from the wallet funded by the NFT buyer, alongside larger payments from Bitget-listed TRON wallets:

• The NFT-linked wallet sent 79.87 TRX (about $27) and 500 USDT (about $500) to one TRON address through deBridge on 4 October. It still held 81.34 ETH, quoted at about $219,000, at the 13:37 UTC snapshot. The bridge records establish both ends of the payments; attribution of the underlying NFT route to the theft remains supported. The new TRON payments.
• Bitget-listed TRON wallets paid about $851,000 to six addresses that Bitget labels as OTC desks or suspected OTC desks. The payments totalled 309,974 USDT ($309,932) and 541,845 USDD ($541,317) between 06:29 and 12:04 UTC on 4 October. The payments by recipient.
• Bitcoin addresses in the Zcash-swap group held 43.0 BTC, quoted at $3.66 million, at block 969,856 on 4 October. The balance is established on the public chain; the group’s link to the theft remains supported. The dated Bitcoin balance.

Dollar quotes use the dated prices. These are movements and snapshots of funds already being traced; amounts at successive stages of a route are counted once.

Update, 4 October: Zcash swaps led to TRON and an NFT sale

The new routes include a Bitcoin cash-out to TRON on 1 October and an NFT sale on 3 October, funded by Zcash swaps:

• Twenty-seven Zcash-to-Bitcoin swaps on 1 October exchanged 1,823.99 ZEC ($2.37m) for 30.72 BTC ($2.60m). Four of their payouts were spent together with a payout from 30 September. The joint spend establishes the public link across both days; the wider group’s connection to the theft is supported by shared order settings and the cash-out route. The payouts.
• 10.82 BTC ($917,000) went through Unit into two Hyperliquid accounts, was sold for USDC and crossed to TRON as USDT. The two accounts combined their proceeds on Arbitrum; 904,123 USDT ($904,123) arrived on TRON on 1 October. The cash-out.
• An NFT bought for 0.14 ETH ($376) on 2 October sold for 219 ETH ($588,000) the next morning. Its buyer’s funds came from two shielded Zcash-to-ETH swaps. The seller sent the proceeds through four intermediary wallets first funded on 23 September, ending at a wallet labelled “Bybit: Wallet 55” by Blockscout. The public path is established; its connection to the theft is supported. The NFT sale.

Update, 3 October: 1,004 more ZEC shielded, and TRON wallets paying OTC desks

What we found on 3 October:

• The 1,004.02 ZEC ($1,303,414) that sat at t1gNZpuH… went into Zcash’s Ironwood shielded pool at 14:55 UTC on 3 October. The main wallet’s 8,582.56 ZEC ($11.14m) was then the only transparent Zcash balance Bitget counted. The transaction.
• Wallets on Bitget’s list paid 366,297 USDT ($366,297), 45,662 USDD ($45,625) and 74,852 TRX ($25,210) to six addresses Bitget’s tracker labels as OTC desks or suspected OTC desks between 15:00 UTC on 2 October and 13:25 UTC on 3 October. A listed wallet put 1,088,110 USDD ($1,087,233) into the JustLend lending protocol on 1 October, and Tether blacklisted two listed wallets at 16:47 UTC on 2 October, both holding USDD rather than USDT. The transfers.
• Two more coinjoins took 0.71354782 BTC ($60,509) on 2 October, THORChain payouts to a wallet on Bitget’s list. The rounds.
• The three wallets reported on 2 October held $425,646 at the 3 October check: 4.37667906 BTC and 0.59110535 BTC unmoved, and TYjFB3sT…, which took 23,613 TRX ($7,952) from a listed wallet on 2 October and on 3 October paid 4,552 USDT to the same address it paid on 29 September. Tether’s contract still lets it send USDT. All three, and the 21 funding wallets, remained outside Bitget’s list, then 4,881 addresses. The wallets.
• Bitget’s tracker listed 4,881 addresses at 15:17 UTC on 3 October, with $359.37m held and $25.15m untraced, and Bitget says its phased withdrawal plan was completed on 2 October. The ledger.
• SlowMist’s report, released by Bitget on 30 September with Mandiant’s, dates the earliest malicious activity to 31 August. Mandiant dates the privileged access to 24 September, and the two describe a web shell on a security appliance and a custom withdrawal tool that forged risk-control parameters. Chainalysis attributed the theft to North Korea on 1 October. What the investigators found.

Prices: Chainlink's BTC/USD of $84,800.47 (14:49 UTC on 3 October) and ETH/USD of $2,680.33 (15:08 UTC on 3 October); CoinGecko's ZEC at $1,298.19, TRX at $0.3368 and USDD at $0.9992 (15:43 UTC on 3 October); USDT at $1. Balances were read on chain between 15:19 and 15:43 UTC on 3 October.

Update, 2 October: three more wallets hold $426,029

What we found on 2 October:

• $426,029 sits in three wallets outside Bitget’s 4,852-address list: 4.37667906 BTC and 0.59110535 BTC in two Bitcoin wallets, and 1,051.35 USDT on TRON. How each traces back.
• Twenty-one wallets paid for the attacker’s Chainflip swaps. They sent 1,053.99 ETH ($2,850,049), 1,342,689 USDT and 1,491.61 SOL ($178,680) into swaps that paid 51.50 BTC ($4,405,537) to Bitcoin wallets Bitget lists as the attacker’s. All were empty or held dust at that check. The wallets.
• Three coinjoin outputs were gathered into the attacker’s wallets. On 29 September three outputs of one coinjoin, 0.03805084 BTC ($3,255), were spent together with eight coins from Bitget-listed wallets into one listed wallet, which holds 22.81490177 BTC ($1,951,739). The transactions.
• The small Zcash route has a second swap. A 1 ZEC swap named the same one-off refund address as the 0.381 ZEC swap, and paid a wallet Bitget lists. Both swaps.
• Bitget’s tracker listed 4,852 addresses at 15:49 UTC on 2 October, with $361.31m held and $22.50m untraced. The ledger.

Prices: Chainlink's BTC/USD of $85,546.69 and ETH/USD of $2,704.06 (14:55 UTC on 2 October), CoinGecko's SOL at $119.79 (15:49 UTC on 2 October), and USDT at $1. Balances were read on chain at 15:49 UTC on 2 October.