For business
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
AML certification
How industry players can get up-to-date knowledge and professional certification.
AML certification
How industry players can get up-to-date knowledge and professional certification.
Comprehensive transaction analytics that helps to build graphs and trace funds.
Graph
Travel rule
(soon)
For personal use
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Crypto recovery
Services are focused on tracking
and recovering crypto assets.
and recovering crypto assets.
Сrypto recovery
Services are focused on tracking
and recovery crypto assets.
and recovery crypto assets.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Portfolio tracker
Information about all assets and risk assessment in one place.
Portfolio tracker
Information about all assets and risk assessment in one place.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
Для себя
Для Бизнеса
Travel rule
(Cкоро)
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Observation period: September 24–28, 2026. Funds are still moving; all figures reflect the latest verified snapshot.
After the attack on Bitget, the stolen funds were spread across eight blockchain networks. The movement soon narrowed to a few repeating routes. Assets were split across fresh wallets, swapped on decentralized exchanges (DEXs), bridged between networks, and gradually converted into Ethereum, Bitcoin and stablecoins.
Ethereum became the main hub, and the cross-chain services THORChain, Chainflip, LayerZero and Across played the central role in moving funds between networks. At the latest snapshot, the largest new Bitcoin position, about 87.82 BTC, was still traceable and had not been mixed. An earlier Bitcoin stream had already gone through the Wasabi CoinJoin mixer, and past that point it can no longer be followed with certainty.
The fund movements were tracked using BitOK’s Graph tool.
Ethereum became the main hub, and the cross-chain services THORChain, Chainflip, LayerZero and Across played the central role in moving funds between networks. At the latest snapshot, the largest new Bitcoin position, about 87.82 BTC, was still traceable and had not been mixed. An earlier Bitcoin stream had already gone through the Wasabi CoinJoin mixer, and past that point it can no longer be followed with certainty.
The fund movements were tracked using BitOK’s Graph tool.
Contents:
- At a glance
- The four main storage wallets
- Branch 1: Ethereum, the main transit route
- Branch 2: TRON, from TRX to stablecoins to Bitcoin
- Branch 3: BNB Chain, a mixed trail
- Branch 4: XRP Ledger, the most fragmented branch
- Bitcoin and the Wasabi mixer
- Where the funds are now
- Key findings
At a glance
At a glance
Networks involved | 8 |
Main storage wallets | 4 (Ethereum, BNB Chain, TRON, XRP Ledger) |
Confirmed Bitcoin from Ethereum routes | ≈104.20 BTC (≈16.37 via Chainflip + ≈87.82 via THORChain) |
Confirmed Bitcoin from the TRON branch | ≈20.47 BTC |
Bitcoin payouts found on BNB routes | ≈45.12 BTC (includes funds from other sources) |
Largest unmixed Bitcoin position | ≈87.82 BTC in 10 unspent outputs |
Already mixed | Part of the TRON-origin Bitcoin, via Wasabi CoinJoin |
The four main storage wallets
The four main storage wallets
After the first withdrawals, the funds gathered in four primary addresses, one per network:
Network | Main storage address | Amount observed | Status at latest snapshot |
Ethereum | 0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899 | ~10,000 ETH | Almost empty, funds moved onward |
BNB Chain | 0x150889fe4fa7a7699588f75c4189fa9e721acfd3 | 5,896.579994 BNB | Almost empty |
TRON | TBWNguTTgezw9dVorX441C6nDrZpRxYwKD | 20,593,360.813864 TRX | Almost empty |
XRP Ledger | rwNhefsz1UQEusxhCvHip3RANinWi4CTck | 102,976,677 XRP | About 3 XRP left |
These wallets were the starting points for further splitting. Their outflows should not be added to the turnover of the wallets that came after them. Those are consecutive stages of the same flow, and adding them together would count the same money twice.
Movement of stolen funds from two Bitget addresses through several layers of intermediate wallets. The funds reach Linea Bridge, THORSwap, LayerZero, Umbra.cash and other addresses. Chart made with BitOK Graph.
Branch 1: Ethereum, the main transit route
Branch 1: Ethereum, the main transit route
Route: ETH moves to new wallets and passes through DEXs, CoW, SkipGo and LayerZero. It then reaches Bitcoin via Chainflip or THORChain.
Ethereum was the backbone of the whole operation. It received direct transfers and funds returning from layer-2 networks. It hosted swaps through CoW and SkipGo, and it was the launch point for the large conversions into Bitcoin.
The ETH was distributed across new wallets. Arbitrum, Optimism, Base and Avalanche served as extra transport layers: funds passed through them, returned to Ethereum, were converted into ETH or USDC, and were sent onward again.
Two confirmed routes took the money from Ethereum into Bitcoin:
Ethereum was the backbone of the whole operation. It received direct transfers and funds returning from layer-2 networks. It hosted swaps through CoW and SkipGo, and it was the launch point for the large conversions into Bitcoin.
The ETH was distributed across new wallets. Arbitrum, Optimism, Base and Avalanche served as extra transport layers: funds passed through them, returned to Ethereum, were converted into ETH or USDC, and were sent onward again.
Two confirmed routes took the money from Ethereum into Bitcoin:
- Chainflip: 13 Bitcoin payouts totaling 16.37484761 BTC.
- THORChain (newer branch): 31 Bitcoin payouts totaling 87.82301390 BTC.
Together, the two routes delivered 104.19786151 BTC.
Branch 2: TRON, from TRX to stablecoins to Bitcoin
Branch 2: TRON, from TRX to stablecoins to Bitcoin
Route: TRX is split across 13 addresses and swapped for USDT on SUN.io. The USDT is bridged to Ethereum via USDT0, then swapped through CoW, UniswapX and THORChain into Bitcoin. Part of that Bitcoin goes into Wasabi CoinJoin.
The TRON branch started with about 20.59 million TRX. The main wallet sent out all of it, 20,593,360.813864 TRX, splitting it among 13 addresses. The TRX was then swapped on SUN.io for at least 5.00 million USDT. Of that, 4.99 million USDT was moved to Ethereum through the USDT0 bridge.
On Ethereum, the funds went through CoW, UniswapX and THORChain. The confirmed Bitcoin output of this branch is 20.46604221 BTC. Part of that Bitcoin later went into Wasabi CoinJoin.
The TRON branch started with about 20.59 million TRX. The main wallet sent out all of it, 20,593,360.813864 TRX, splitting it among 13 addresses. The TRX was then swapped on SUN.io for at least 5.00 million USDT. Of that, 4.99 million USDT was moved to Ethereum through the USDT0 bridge.
On Ethereum, the funds went through CoW, UniswapX and THORChain. The confirmed Bitcoin output of this branch is 20.46604221 BTC. Part of that Bitcoin later went into Wasabi CoinJoin.
Branch 3: BNB Chain, a mixed trail
Branch 3: BNB Chain, a mixed trail
Route: BNB is split across 3 addresses and then moved through THORChain and Across. The THORChain routes lead to Bitcoin.
The main BNB wallet sent its full balance of 5,896.579994 BNB to three addresses. From there, funds moved through THORChain and Across. The THORChain routes found so far produced Bitcoin payouts totaling 45.11937016 BTC.
That figure comes with an important caveat. The intermediate addresses also received money from other sources, so 45.12 BTC is the total of all payouts found on these routes, not a clean measure of Bitget funds. The exact share from the original BNB branch cannot be determined without a chosen taint model, a method for deciding how mixed funds are attributed to their sources.
The main BNB wallet sent its full balance of 5,896.579994 BNB to three addresses. From there, funds moved through THORChain and Across. The THORChain routes found so far produced Bitcoin payouts totaling 45.11937016 BTC.
That figure comes with an important caveat. The intermediate addresses also received money from other sources, so 45.12 BTC is the total of all payouts found on these routes, not a clean measure of Bitget funds. The exact share from the original BNB branch cannot be determined without a chosen taint model, a method for deciding how mixed funds are attributed to their sources.
Branch 4: XRP Ledger, the most fragmented branch
Branch 4: XRP Ledger, the most fragmented branch
Route: XRP is split across 5 wallets. From there it is sent out in 479 payments to busy addresses where it mixes with other funds.
XRP was split more heavily than any other asset. The 102,976,677 XRP from the main wallet went to five wallets. Those wallets made 479 payments into high-turnover addresses where the funds mixed with money from other sources.
Only two clear exits have been confirmed:
XRP was split more heavily than any other asset. The 102,976,677 XRP from the main wallet went to five wallets. Those wallets made 479 payments into high-turnover addresses where the funds mixed with money from other sources.
Only two clear exits have been confirmed:
- 49,000 XRP went to a Binance deposit address.
- 3,000 XRP was swapped through SwftSwap into 1.704496 ETH on Ethereum.
The rest of the XRP kept moving inside these mixed addresses. No single final wallet has been identified.
Bitcoin and the Wasabi mixer
Bitcoin and the Wasabi mixer
Bitcoin came from three main sources: Ethereum via Chainflip, Ethereum via THORChain, and TRON/BNB via THORChain. The two Bitcoin streams now look very different.
The new, unmixed branch. The newer Ethereum-to-THORChain branch produced 87.82301390 BTC. After several consolidations, 87.82296506 BTC can still be traced across ten unspent Bitcoin outputs (UTXOs). These ten outputs hold 101.78385303 BTC in total, more than the traced amount, because two of the consolidations pulled in extra funds from other sources. So far this route shows no sign of CoinJoin, which makes it the most important position to watch.
The earlier, mixed branch. Bitcoin from the TRON/USDT0 branch reached Wasabi. In one confirmed round, three linked inputs worth 4.62575396 BTC joined a CoinJoin with 110 inputs and 145 outputs. Two other linked rounds had 335 inputs and 367 outputs, and 270 inputs and 320 outputs.
The new, unmixed branch. The newer Ethereum-to-THORChain branch produced 87.82301390 BTC. After several consolidations, 87.82296506 BTC can still be traced across ten unspent Bitcoin outputs (UTXOs). These ten outputs hold 101.78385303 BTC in total, more than the traced amount, because two of the consolidations pulled in extra funds from other sources. So far this route shows no sign of CoinJoin, which makes it the most important position to watch.
The earlier, mixed branch. Bitcoin from the TRON/USDT0 branch reached Wasabi. In one confirmed round, three linked inputs worth 4.62575396 BTC joined a CoinJoin with 110 inputs and 145 outputs. Two other linked rounds had 335 inputs and 367 outputs, and 270 inputs and 320 outputs.
A note on the names: Wasabi is the wallet and service, and WabiSabi is the protocol it uses to run modern CoinJoin rounds. After such a round, the public blockchain cannot show which input matches which output. From that point on, investigators can only estimate likely candidates. They cannot prove where the money went.
Bitcoin flows from three source addresses split into about 20 new wallets, many of which still hold their balances. Transfers go into Wasabi CoinJoin. Chart made with BitOK Graph.
Where the funds are now
Where the funds are now
Branch | Current observed position |
Ethereum | 50,163.844466 ETH remained in eight main Ethereum wallets as of Sept 28, 11:47 UTC |
New Ethereum-to-Bitcoin | 87.82296506 BTC traceable in ten unspent UTXOs; no CoinJoin detected |
Chainflip | 16.37484761 BTC withdrawn to Bitcoin; 3.16627430 BTC remained in a Chainflip liquidity-provider (LP) account at the previous snapshot |
TRON-to-Bitcoin | Partly in mixed Bitcoin UTXOs, partly passed through Wasabi CoinJoin |
BNB-to-Bitcoin | First Bitcoin outputs spent and mixed; exact share of the original BNB branch not established |
XRP | 49,000 XRP to Binance, 3,000 XRP out to Ethereum, the rest in mixed XRP addresses |
The original storage wallets on Ethereum, BNB Chain and TRON are practically empty. The value that can still be observed sits in four places: Ethereum storage wallets, unspent Bitcoin UTXOs, mixed Bitcoin flows after THORChain, and high-turnover XRP addresses.
Key findings
Key findings
- The funds moved across eight networks, but the main routes converged on Ethereum and Bitcoin.
- THORChain was used in the Ethereum, TRON and BNB branches. Other parts of the flow went through Chainflip, LayerZero, Across and other services.
- The largest new Bitcoin position, about 87.82 BTC, is still traceable and has not entered CoinJoin.
- The earlier Bitcoin stream reached Wasabi CoinJoin, and the exact distribution of its outputs can no longer be determined.
- Service addresses, bridges, exchanges and mixed pools mark the limit of what can be observed. Funds reaching them does not prove who owns everything held there.
