AMLBot Followed Four BTC of Bitget's Breach Into a Wasabi CoinJoin
Withdrawals are back on four chains. The four BTC the tracer followed are inside a coinjoin.
Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure at 18:31 UTC on September 24, 2026, and put the estimated loss at $387.5 million[1]. Attackers exploited a flaw in a third-party security product to forge withdrawal commands that bypassed risk checks, the exchange said[2].
AMLBot traced roughly four BTC connected with the breach into a Wasabi CoinJoin, after funds moved from Tron through USDT0, Ethereum and THORChain[3].
Bitget restored BTC, ETH and USDT withdrawals on September 30, with USDT open across Ethereum, BNB Smart Chain, Solana and Tron[4][5]. It offers 5 percent for funds frozen and 5 percent for recoveries[6]. The four traced BTC sit inside a coinjoin[3].
What to do: no action needed — the exchange says customer account balances were unaffected[7].
Who gains, who loses
Receipts
Bitget said the September 24, 2026 incident involved unauthorized transfers from its hot and warm wallet infrastructure and that the estimated loss was $387.5 million.
“The incident began at 18:31 UTC on Sept. 24 when Bitget detected unauthorized transfers from portions of its hot and warm wallet infrastructure.”
Bitget said the attackers exploited a vulnerability in a third-party security product to obtain access credentials and forge withdrawal commands that bypassed risk checks.
“Its investigation found that attackers exploited a vulnerability in a third-party security product to obtain access credentials and forge withdrawal commands that bypassed risk checks.”
AMLBot traced roughly four BTC connected with the Bitget breach into a Wasabi CoinJoin transaction after funds moved from Tron through USDT0, Ethereum and THORChain.
“AMLBot traced roughly four BTC connected with the breach into a Wasabi CoinJoin transaction after funds moved from Tron through USDT0, Ethereum and THORChain.”
Bitget restored BTC, ETH and USDT withdrawals on September 30, 2026, while P2P, fiat and remaining token withdrawals were scheduled to return on October 2, 2026 at 08:00 UTC.
“Bitget has restored BTC, ETH and USDT withdrawals after its $387.5 million security breach, while P2P, fiat and remaining token withdrawals are scheduled to return Friday.”
USDT withdrawals reopened on Bitget across Ethereum, BNB Smart Chain, Solana and Tron on September 30, 2026.
“USDT withdrawals reopened Sept. 30 across Ethereum, BNB Smart Chain, Solana and Tron, according to Chen’s latest update.”
Bitget offered a 5% bounty for qualifying assistance that resulted in stolen funds being frozen and a separate 5% reward for successful recoveries.
“Bitget has offered a 5% bounty for qualifying assistance that results in stolen funds being frozen and a separate 5% reward for successful recoveries.”
Bitget said customer account balances were unaffected while withdrawals were suspended for security validation.
“The exchange maintains that customer account balances were unaffected and that the temporary halt was introduced while its technical teams validated the affected systems.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.