According to crypto.news, the follow-up flow of funds from a large-scale security incident at Bitget exchange has been exposed, involving a total of $387 million, with currently only $840,000 frozen. The fund paths involve Bitcoin, THORChain, and CoinJoin. This is a disclosure of the subsequent movement of funds from a past theft, rather than a report of a new attack; the currently verifiable facts mainly center on the disclosure of the fund paths and the frozen amount.
In terms of amount comparison, the $387 million stolen scale and the $840,000 frozen amount appear side by side in the disclosure, with the latter accounting for an extremely low proportion of the former. The two figures directly show that after the stolen funds entered on-chain circulation, the portion actually confirmed as frozen is very limited. The entity executing the freeze has not been made public, nor is it clear which portion of assets the $840,000 corresponds to. This contrast is one of the most central pieces of information in this disclosure.
The fund path is the focus of this follow-up disclosure. The related asset flows involve Bitcoin, THORChain, and CoinJoin. Their simultaneous appearance means the scope of fund tracing is not limited to a single network or a single asset type, but needs to cover multiple on-chain paths and different transfer tools. Based on the disclosure, the overall direction of fund flows is clear, but the specific amounts, chronological order, and number of addresses for each path have not been made public, and follow-up tracing still needs further refinement.
On the security front, whether the disclosed paths can help trace the remaining funds has become a main focus after the incident was exposed. From the amount comparison, the freezing of $840,000 means the vast majority of stolen funds remain unfrozen. Because the paths involve Bitcoin, THORChain, and CoinJoin, follow-up tracing requires cross-verification across multiple networks and tools, making the handling chain longer. Public information has not yet stated whether the unfrozen funds are still in known addresses, nor whether more addresses have been identified.
On the compliance front, the source material describes the security and compliance attention for this incident as extremely high. The fund paths involve multiple blockchain networks and tools at the same time, meaning the complexity of related address tagging, asset freezing, and cross-institutional coordination has increased. Current public information has not yet disclosed whether the relevant addresses have been tagged, nor whether trading platforms or other institutions have taken further restrictive measures. Therefore, the disclosed compliance information mainly centers on the path disclosure itself, rather than specific handling results.
From an impact perspective, the frozen amount accounts for an extremely low share of the total stolen amount, indicating that current on-chain handling has not yet achieved effective interception, and fund recovery faces significant uncertainty. Paths involving CoinJoin and others further increase the difficulty of cross-chain data stitching and address clustering. Because this disclosure does not include the specific attack time, attack method, or responsible party, the related content is an interim update on the follow-up dynamics of an existing security incident, rather than a complete event retrospective.
Directions worth watching going forward include: whether the frozen amount increases further; the specific destination of unfrozen funds; whether related on-chain addresses are more widely tagged; and whether exchanges or law enforcement agencies disclose more tracing and handling results. This information will determine the incident's further impact on exchange security incident disclosure and compliance tracing.
.jpg)