Blockchain analytics and compliance platform AMLBot said funds linked to the Bitget theft appear to have entered Wasabi CoinJoin. According to the Wu Blockchain report on AMLBot’s tracing, the company connected roughly 4 BTC in one CoinJoin round to a Bitget wallet on TRON.
The traced route crossed several assets and networks before reaching Bitcoin. AMLBot said the funds moved from TRX into USDT, crossed to Ethereum through USDT0, were swapped into approximately 145 ETH, and then passed through THORChain into roughly 4.59 BTC. The Bitcoin was subsequently split and sent into CoinJoin. For broader Bitcoin context, BTC-Pulse has also covered Bitcoin’s digital-gold debate.
The transaction path reported by AMLBot
AMLBot’s account describes a multi-stage route rather than a direct transfer from a Bitget-linked wallet to Wasabi. It begins on TRON with a conversion from TRX to USDT. The report then identifies USDT0 as the bridge used to move value to Ethereum, where the funds were exchanged into about 145 ETH. Separate BTC-Pulse coverage tracks recent US spot Bitcoin ETF activity, while this event centers on the movement of identified funds.
From Ethereum, the reported path continued through THORChain and resulted in around 4.59 BTC. AMLBot said the Bitcoin was divided before entering CoinJoin. The source’s two figures describe different points in the account: roughly 4.59 BTC after the THORChain stage and about 4 BTC linked to one CoinJoin round. Other Bitcoin market coverage includes Bitcoin and Ether fund flows, but AMLBot’s findings concern transaction tracing.
What AMLBot says it is monitoring
AMLBot said it blacklisted the addresses connected with the activity. It also said it is monitoring the attacker’s BTC for additional CoinJoin activity. Those actions are the only follow-up measures described in the cited report.
The wording of the report remains appropriately qualified. It says some funds linked to the Bitget theft appear to have entered Wasabi CoinJoin, and it attributes the tracing conclusions to AMLBot. The report does not state that all funds associated with the theft followed this route, nor does it provide a broader total beyond the amounts described in this specific sequence.
Why the Bitcoin stage is central
Bitcoin is the final asset identified in the reported conversion path and the asset sent into CoinJoin. That makes the Bitcoin stage central to AMLBot’s account even though the route began on TRON and passed through Ethereum. The sequence also explains why the report distinguishes the approximately 4.59 BTC produced through THORChain from the roughly 4 BTC associated with one CoinJoin round.
For now, the documented development is limited to AMLBot’s tracing statement: a Bitget-linked route across TRX, USDT, USDT0, ETH, THORChain and BTC; a split before CoinJoin; the blacklisting of related addresses; and continued monitoring for further CoinJoin activity.
