AMLBot said on Sept. 27 that roughly 4 BTC linked to the Bitget hack had entered a Wasabi CoinJoin round after moving across several networks. The tracing firm connected the funds to a Bitget-linked TRON wallet, identifying a route through USDT, Ethereum, THORChain, and Bitcoin before the assets reached CoinJoin infrastructure.
The information brings another aspect to the investigation regarding Bitget’s security breach that occurred on September 24, which the exchange now values at approximately $387.5 million. According to Bitget, the updated loss amount includes other currencies such as Zcash and TRON, which have been left out of the original $351.6 million estimate.
Also Read | AERO Price Eyes $5 Target as Breakout Aligns With Network Expansion
Bitget Hack Funds Cross Multiple Networks
AMLBot’s tracing began with funds held in a Bitget-linked TRON wallet. The first step in the tracing process was to convert the assets from TRX into USDT and then move it to Ethereum using USDT0. Once on Ethereum, the assets were converted to approximately 145 ETH, forming yet another part of the cross-chain.
This was followed by the routing of the ETH through THORChain where it was further converted to approximately 4.59 BTC as per the report of AMLBot. The Bitcoin was later split and used in a Wasabi CoinJoin round, wherein approximately 4 BTC related to the earlier activity at Bitget were found by the analytics company.
CoinJoin is a process where several inputs of Bitcoin are combined together to form one transaction and then distribute the assets in various outputs. As per the documentation by Wasabi, the process is intended to sever the direct relationship between an input and its respective output but does not mean that the whole transaction disappears from the blockchain.
Bitget Raises Hack Estimate to $387.5M
Bitget estimated the total assets being moved to attacker-controlled addresses to be about $351.6 million in the Sept. 24 hack, with further analysis raising the amount to about $387.5 million by adding assets on Zcash and TRON that weren’t part of the original calculation.
The assets affected by the hack include Ethereum and other Ethereum Virtual Machine-based networks, XRP Ledger, Zcash, and TRON. The exchange named XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX as some of the affected assets. The hack is stated by Bitget to still be contained with no additional unauthorized transactions.
GoPlus Security added that from their investigation, the hack was not as a result of the exposure of private keys. Rather, it was an attack involving a compromise of the trust chain for the transaction signing, where hackers purportedly compromised the important wallet backend, tampered with the transaction data and got Bitget’s authorized transaction signing to sign out transfers not intended by Bitget.
GoPlus Security added that the window for draining funds was about two hours and 25 minutes, with the largest batch being about $185 million in one minute. They have blacklisted the hacker addresses and shared them with partners in the ecosystem. Bitget has not yet released a full technical report detailing the initial entry point of the attack.
Dormant Funds Remain Under Monitoring
However, Wasabi wallets are just one aspect of the total value associated with Bitget hacking. According to estimates by AMLBot, as of Sept. 25, approximately $343 million, which is 88% of the funds that were under its control, remain dormant in 13 wallets owned by the hackers.
Those wallets contain large amounts of ETH, XRP, and ZEC, AMLBot has noted in its report. This distinction is crucial because 4 BTC discovered in CoinJoin transactions belong to already processed funds, while other assets are still stored in wallets where no transactions took place after them.
Furthermore, the cross-chain process explains why fund tracing may require investigation of multiple blockchains at once. As assets are transferred from one chain to another using bridge solutions and cross-chain liquidity, they are first converted into other cryptocurrencies before being transferred to another network.
Bitget Starts Phased Withdrawal Resumption
Bitget has also started preparation to restart the withdrawals process once they have identified and rectified the problem behind the issue. The firm said Mandiant and SlowMist are helping them validate their security on the withdrawal infrastructure amid its reopening schedule.
The withdrawal of Bitcoin is expected to restart from 08:00 UTC on Sept. 28. The withdrawal of ETH on Ethereum, BSC, Arbitrum, Base, and Optimism is expected on Sept. 29, followed by the withdrawal of USDT on Ethereum, BSC, Solana, and Tron on Sept. 30. Withdrawals for other coins, fiat, and P2P are scheduled on Oct. 2.
Bitget further explained that the balances of users are unaffected and its Protection Fund is covering the financial losses caused by the incident. The trading and deposits are working fine despite the withdrawal issues. It has also mentioned that it continues to investigate and recover the hack as the firms monitor the movement of the assets linked to the attackers.
In the case of the Bitget hack, the immediate focus will be split into two halves where they are tracking down the moving assets and those which are sleeping. The detection of about 4 BTC in Wasabi CoinJoin made by AMLBot adds another chain link for the investigators, while the reopening of withdrawal by Bitget means the next phase of operations.
Also Read | QNT Price Surges Above $100 as Quant Unveils New Tokenized Deposit Whitepaper
Be the first to comment