Bitget Hacker Converts Stolen Assets Into Nearly 1,890 BTC as Laundering Operation Expands

Frank Joaquin

Date: September 28, 2026

The attacker behind Bitget’s September 24 security breach has begun consolidating a substantial portion of the stolen assets into Bitcoin, expanding the incident from a theft and recovery operation into an active cross-chain laundering campaign.

By 14:28 UTC on September 27, addresses attributed by Bitget to the attacker held approximately 1,889.58 BTC worth $160.1 million, based on a transaction reconstruction by YFarmX using Bitget’s published attacker addresses and blockchain records.

The Bitcoin was not stolen directly from Bitget. Investigators traced conversions involving assets originally taken during the breach, including XRP, ETH, ZEC, TRX, BNB, ALGO, TIA, ATOM and stablecoins. A growing share of that portfolio has been routed through swaps and cross-chain infrastructure before arriving in Bitcoin.

The XRP portion of the theft has moved particularly quickly. On Saturday, roughly $83 million in stolen XRP had already left three of the attacker’s five original holding wallets. By Sunday morning, the final original XRP wallet had made its last major outgoing payment, leaving only about 185,000 XRP classified as still moving through swaps, according to YFarmX.

Blockchain records show the XRP being transferred through multiple swaps, bridges and intermediate assets before portions were converted into Bitcoin. The movement should not be described simply as an XRP sale because the traced routes involve several stages and different protocols.

Ethereum funds also began moving Sunday. One of eight major attacker-controlled ETH wallets, originally holding 10,000 ETH, initiated its first outgoing transaction at approximately 07:40 UTC. By about 14:31 UTC, roughly 2,620 ETH worth $7.1 million had left that address.

The traced route included conversions from ETH into USDC through decentralized trading infrastructure, followed by transfers using Circle’s Cross-Chain Transfer Protocol into Noble in the Cosmos ecosystem. Funds then moved through additional routes before some value reached Chainflip and was converted into Bitcoin. The remaining seven major Ethereum wallets still held approximately 58,923 ETH worth about $159.6 million at the time of the reconstruction.

Bitcoin is emerging as the attacker’s primary destination asset. The attributed BTC balance increased by approximately 352.5 BTC between 00:43 UTC and 14:28 UTC Sunday, bringing the total to nearly 1,890 BTC.

The shift toward Bitcoin complicates recovery efforts. Stablecoin issuers such as Circle and Tether can blacklist specific addresses, and approximately $339,000 connected with the Bitget theft has already been frozen. Native Bitcoin does not have an issuer-controlled freeze mechanism. XRP also lacks that type of centralized freeze function, but Bitcoin offers considerably deeper liquidity and a larger ecosystem of cross-chain and privacy infrastructure.

Some of the stolen Bitcoin has already entered privacy-enhancing transactions. YFarmX identified approximately 19.23 BTC connected with the attacker’s swap proceeds entering CoinJoin transactions. Separately, crypto.news reported that four BTC associated with the Bitget attacker moved through Wasabi CoinJoin after passing across several blockchains and swap routes.

CoinJoin does not make Bitcoin transactions impossible to trace, but it makes analysis more difficult by combining inputs and outputs from multiple participants into shared transactions. So far, the amounts entering CoinJoin remain small compared with the attacker’s roughly $160 million Bitcoin position.

The breach has also created a dispute over how decentralized protocols should respond to identified stolen funds. Bitget CEO Gracy Chen publicly asked THORChain validators to refuse transactions linked to the attacker’s known addresses. THORChain has not done so. The protocol’s permissionless design does not provide Bitget with the same ability to intervene that exists at centralized exchanges or through stablecoin issuers. Reporting on the dispute indicates that several million dollars in stolen assets have already passed through THORChain routes.

Bitget is moving ahead with its operational recovery at the same time. The exchange has said withdrawals will resume in stages beginning September 28, with restoration expected to continue through October 2. Bitget maintains that its protection fund is sufficient to cover customer losses and that the vulnerability used in the attack has been contained.

TOKEN RECON ASSESSMENT

The most important change is not simply that stolen funds are moving. It is that the attacker is systematically transforming a multi-asset portfolio into Bitcoin while beginning to use privacy-enhancing infrastructure.

That makes recovery harder. Stablecoin issuers can freeze certain assets, and centralized exchanges can intervene when stolen funds reach identified accounts. Bitcoin provides neither protection automatically.

The remaining seven major Ethereum wallets are now a critical intelligence point because they still contained nearly 59,000 ETH when last reviewed. Significant movement from those wallets would indicate that the asset-conversion operation is accelerating.

Bitget’s staged withdrawal restoration creates the other key test. If withdrawals resume as scheduled without additional unauthorized outflows, the exchange’s claim that the breach has been contained becomes more credible. The stolen assets, however, are already entering a more difficult recovery phase.