Back bitok.org

Bitget Attack Trace

bitok.org • October 4, 2026

Movement of stolen funds from two Bitget addresses through several layers of intermediate wallets. The funds reach Linea Bridge, THORSwap, LayerZero, Umbra.cash and other addresses. Chart made with BitOK Graph .

Branch 1: Ethereum, the main transit route

Chainflip: 13 Bitcoin payouts totaling 16.37484761 BTC.

THORChain (newer branch): 31 Bitcoin payouts totaling 87.82301390 BTC.

Branch 2: TRON, from TRX to stablecoins to Bitcoin

Branch 3: BNB Chain, a mixed trail

Branch 4: XRP Ledger, the most fragmented branch

49,000 XRP went to a Binance deposit address.

3,000 XRP was swapped through SwftSwap into 1.704496 ETH on Ethereum.

Bitcoin and the Wasabi mixer

Where the funds are now

Current observed position

50,163.844466 ETH remained in eight main Ethereum wallets as of Sept 28, 11:47 UTC

New Ethereum-to-Bitcoin

87.82296506 BTC traceable in ten unspent UTXOs; no CoinJoin detected

16.37484761 BTC withdrawn to Bitcoin; 3.16627430 BTC remained in a Chainflip liquidity-provider (LP) account at the snapshot

Partly in mixed Bitcoin UTXOs, partly passed through Wasabi CoinJoin

First Bitcoin outputs spent and mixed; exact of the original BNB branch not established

49,000 XRP to Binance, 3,000 XRP out to Ethereum, the rest in mixed XRP addresses

The funds moved across eight networks, but the main routes converged on Ethereum and Bitcoin.

THORChain was used in the Ethereum, TRON and BNB branches. Other parts of the flow went through Chainflip, LayerZero, Across and other services.

The largest new Bitcoin position, 87.82 BTC, is still traceable and has not entered CoinJoin.

The earlier Bitcoin stream reached Wasabi CoinJoin, and the exact distribution of its outputs can no longer be determined.

Service addresses, bridges, exchanges and mixed pools mark the limit of what can be observed. Funds reaching them does not prove who owns everything held there.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bitget Suffers $388M Hack Attributed to North Korean Lazarus Group On September 24, 2026, Bitget reported a significant security breach resulting in the theft of approximately $388 million from its hot and warm wallets. The attackers exploited a vulnerability in a third-party security product to gain internal access credentials and issued fraudulent withdrawal commands. Bitget's cold wallets remained secure, and private keys were not compromised. The incident has been linked to North Korea's Lazarus Group, known for previous cyberattacks. Following the breach, Bitget temporarily suspended withdrawals and has since resumed them in phases, with a protection fund covering customer losses. Investigations by security firms Mandiant and SlowMist are ongoing, focusing on the attack's methods and tracing the stolen funds, which have begun moving through various mixers and exchanges. As of October 1, 2026, some funds remain unspent, providing a target for ongoing investigations. 5 sources 76

Extracted Entities

Bitget Attack Trace

The full story

Extracted Entities

Companies (1)

Platforms (3)

Tools (3)