Bitget hackers routed 4 bitcoins through Wasabi CoinJoin

Bitget安全漏洞相关资产疑似通过Wasabi CoinJoin进行混币清洗

据区块链合规公司AMLBot报道，部分与Bitget安全漏洞相关的资产在跨越多个区块链及兑换路径后，已进入Wasabi CoinJoin（比特币混币服务）流程。

AMLBot追踪发现，约有4枚BTC与Bitget被盗资金有关，并进入了一轮Wasabi CoinJoin交易。这些资金从TRON网络出发，经过USDT0、以太坊（Ethereum）和THORChain，最终到达用于混币的比特币地址。

Bitget方面已确认，在9月发生的安全漏洞中，约有3.875亿美元被转移至攻击者控制的地址。截至9月25日，AMLBot估计仍有约3.43亿美元处于休眠状态，分布在13个攻击者钱包中。Bitget表示，在查明并修复底层安全漏洞后，计划于9月28日起分阶段恢复提币服务。

混币活动细节追踪

AMLBot在9月27日表示，其追踪工作将一轮CoinJoin交易中约4枚BTC与源自Bitget关联TRON钱包的资金联系起来。该公司将此类活动描述为试图掩盖被盗资产流动迹象的行为。

这一发现紧随Bitget对其被盗资产价值的修订之后。Bitget将其转移到攻击者控制地址的资产总额调整为约3.875亿美元。交易所官方调查更新指出，新总数包含了在其初始3.516亿美元估算中遗漏的Zcash和TRON资产。

根据AMLBot的描述，此次多阶段路由始于TRON网络。据称，攻击者首先将TRX转换为USDT。随后，资金通过USDT0（Tether的多链版本，旨在支持受支持网络间的转账）桥接至以太坊网络。

抵达以太坊后，资产被兑换成约145枚ETH。AMLBot指出，这些ETH随后通过THORChain流转，并被转换为约4.59枚BTC。比特币随后被分割成较小金额，最终进入Wasabi CoinJoin流程。AMLBot的分析显示，可以将该交易中的约4枚BTC回溯至Bitget的TRON钱包。

CoinJoin技术通过将多名参与者的比特币输入和输出合并到同一笔交易中，使得交易追踪变得更加困难，因为区块链观察者无法简单地将一个输入映射到一个对应的输出上。

AMLBot将此活动定性为通过Wasabi CoinJoin进行的洗钱行为，并表示已将相关地址列入黑名单。该公司正在持续监控比特币，以观察是否有进一步的CoinJoin活动。

需要指出的是，这种归因主要基于AMLBot的区块链分析。公共区块链记录显示了地址间的转账、兑换及跨链活动，但每笔交易的目的通常是基于观察到的资金流向和地址归属推断得出的。

Bitget确认损失扩大至3.875亿美元

Bitget initially said the September 24 incident affected approximately $351.6 million in assets in its Hot Wallet and Warm Wallet infrastructure segments due to unauthorized transfers. The exchange detected the activity at 18:31 UTC time and suspended the withdrawal service, but retained deposit and trading functions. According to Bitget's initial announcement, cold wallets remain secure.

As of September 25, Bitget's transaction classification increased the confirmed amount to approximately US$387.5 million. The exchange said the increase did not stem from new theft after the breach occurred. Investigators have previously identified other Zcash and TRON assets involved in the original incident.

Assets affected include ETH, XRP, USDT, USDC, USDT0, ZEC, XAUt, BNB, AVAX and TRX. As part of the recovery effort, Bitget released major attacker control addresses on Ethereum-compatible networks, XRP Ledger, Zcash and TRON.

Bitget's preliminary investigation points to a breach of the backend wallet infrastructure, not a leak of the private key. CEO Gracy Chen said the private key remains secure while investigators determine the exact path of the intrusion. Bitget later said its security team had determined attack paths and ways to bypass existing controls. The company said the underlying vulnerability had been fixed, but has not publicly released a root-cause report containing details of the technology.

Most of the stolen assets are still dormant

This CoinJoin activity accounts for only a small portion of the funds related to the vulnerability.

In a September 25 update, AMLBot said that of the approximately $389 million it tracked, approximately $343 million, or 88 percent, had not yet moved. The company's data is based on addresses it attributes to attackers.

AMLBot identified 13 dormant wallets that hold multiple assets. Eight of these Ethereum wallets contain approximately 68,300 ETH, and four XRP addresses hold approximately 83 million XRPs. The other wallet holds nearly 18,900 ZECs. The company said the 13 addresses had not sent any transactions after receiving funds. Its subsequent Wasabi update involved another portion of stolen funds that had begun to flow between different chains and assets.

Other researchers have also tracked independent conversion activity. Crypto.news reported on September 25 that security researcher Taylor Monahan discovered that the stolen USDC was moved and converted to ETH after the attack. Her findings showed that assets controlled by the attacker were bridged and redeemed after leaving Bitget. The report stated that Circle can freeze USDC at designated addresses when legal requirements are met, but public transaction logs do not confirm whether a qualified legal order was delivered to Circle at the time.

Subsequent AMLBot tracking showed that another part of the money flow crossed from TRON to Ethereum, then entered the Bitcoin network through THORChain, and finally entered the CoinJoin process.

Bitget is preparing to reopen the coin withdrawal service in phases

Bitget is preparing to resume the coin withdrawal service, provided that the vulnerability that caused the incident has been repaired.

According to the exchange's withdrawal schedule, bitcoin withdrawals will resume first on September 28 at 08:00 UTC. ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism will resume on September 29. USDT withdrawals on Ethereum, BSC, Solana and TRON will resume on September 30. Other token withdrawals, fiat services and peer-to-peer withdrawals are expected to return on October 2.

Bitget said Mandiant and SlowMist will continue to assist with security investigations while its technical team conducts verification of the withdrawal infrastructure. As reported by Crypto.news on the opening plan, Bitget said its protection funds will cover the financial losses caused by the incident, and customer account balances will remain unchanged. During the suspension of withdrawals, the exchange reported that the fund held more than $464 million.

A September Proof of Reserve update released before the breach showed that Bitget had a total reserve ratio of 135% on 19 covered assets. The exchange stated that it maintains a reserve ratio of at least 1:1 for user assets covered in the plan. CEO Gracy Chen is scheduled to host a live AMA on September 28 at 07:30 UTC to discuss the incident, the recovery of the withdrawal and the exchange's next steps.