Security firm BlockSec's on-chain tracking shows that $387.5 million in stolen Bitget funds flowed into BTC, THORChain, and CoinJoin, with only $840,000 frozen so far.
Security firm BlockSec has released the results of its on-chain tracking of the stolen Bitget funds. The results show that the amount involved was $387.5 million, the funds have flowed into BTC, THORChain, and CoinJoin, and only $840,000 has been frozen so far. This is the clear data the market has obtained on fund flows and freezing progress since the exchange's security incident.
This tracking involves two entities: Bitget is the exchange whose funds were stolen, and BlockSec is the security firm that released the on-chain tracking results. The source material frames the incident as follow-up tracking of a major exchange security incident, noting that it involves fund flows, mixing channels, and freezing status, and that user interest is high. Three core data points can be confirmed from the source material: total stolen amount of $387.5 million; funds flowed to BTC, THORChain, and CoinJoin; and $840,000 has been frozen. Together, these three data points form the basic factual framework of the tracking results, and subsequent observation centers on these three dimensions.
In terms of fund flows, BTC represents an on-chain transfer path on the Bitcoin network. THORChain, as a cross-chain protocol, is typically used for swaps and routing between assets on different chains; funds entering THORChain mean cross-chain conversion may have occurred. CoinJoin points to the mixing stage, which reduces the associability between addresses by mixing multiple transactions. The appearance of funds across all three types of paths indicates that this tracking cannot remain within a single network but must cover the Bitcoin network, cross-chain paths, and mixing stages simultaneously. Different paths correspond to different on-chain behavioral characteristics: the Bitcoin network is suited to observing direct transfers between addresses; cross-chain paths change the chain on which assets reside, increasing the difficulty of cross-chain tracking; and mixing stages disrupt address associations. The source material summarizes the incident as involving fund flows, mixing channels, and freezing status, consistent with the path distribution shown by the on-chain tracking results.
On the freezing data, compared with the total stolen amount of $387.5 million, the frozen amount of $840,000 is relatively small. This contrast is the most prominent quantitative relationship in the current disclosure. The frozen amount only reflects the portion of funds that have been intercepted and does not equal the final total recovered. The source material did not disclose the entity executing the freeze, the frozen addresses, the relevant jurisdiction, or subsequent return arrangements, so for now it can only be confirmed that $840,000 has been frozen. For major exchange security incidents, fund tracing and freezing are usually phased processes; the current disclosure is an interim result at the on-chain tracking stage, and whether more frozen amounts emerge remains to be seen.
Regarding the incident background, Bitget is the exchange mentioned in this incident, and BlockSec is responsible for on-chain tracking. Unlike the time of an attack, when attention usually focuses more on intrusion methods and scope of impact, post-incident tracking places greater emphasis on fund flows, cross-chain and mixing paths, and freezing effectiveness; therefore, the focus of this disclosure is the on-chain tracking results, not the attack process itself. The source material did not provide the time of the attack, the type of stolen assets, the attack entry point, the number of affected users, Bitget's official response, or the use of insurance or reserve funds. These items fall outside the verifiable scope of these tracking results.
From the perspective of information completeness, the currently confirmable facts center on three levels: total stolen amount, fund destinations, and frozen amount. The specific amounts, sequence, and transfer timetable for each fund channel do not appear in the source material, so it is impossible to determine how much of the funds went through each of the three paths—BTC, THORChain, and CoinJoin. The relationship among the three paths, such as whether funds first passed through the Bitcoin network before entering cross-chain or mixing stages, also cannot be confirmed from the available material. The existing disclosure can illustrate the diversity of fund paths but cannot provide the specific flow order among them. Based solely on the disclosed frozen amount, the frozen portion is far below the total stolen amount. This gap only indicates that the publicly disclosed freezing results are limited; it cannot be used to infer the final recovery ratio, because the location of remaining funds, the success rate of freezing, and recovery targets were not disclosed in the source material. It reflects the state at the current time node of tracking disclosure, not the final outcome of the incident.
From an industry observation perspective, the stolen funds entering BTC, THORChain, and CoinJoin correspond respectively to three scenarios: a single network, cross-chain, and mixing. This result itself provides sample material for observing cross-chain monitoring, mixing identification, and freezing coordination. The source material did not provide information on whether address labels will be updated subsequently, whether Bitget will disclose a response plan, or whether law enforcement agencies are involved. Before further disclosure, what can be confirmed at the industry level remains limited to the tracking results released by BlockSec itself.
For Bitget users, the most direct questions are whether the fund flows are clear, whether frozen funds can be returned, and whether the exchange will clarify the losses. The source material does not provide answers to these questions. The disclosed content only shows that BlockSec tracked the stolen funds to BTC, THORChain, and CoinJoin, and confirmed that $840,000 has been frozen. Matters concerning compensation liability, recovery ratio, and user impact require further clarification from Bitget or official institutions.
Going forward, four areas warrant attention: first, whether the frozen amount rises; second, whether funds continue to move through the Bitcoin network, cross-chain paths, or mixing channels; third, whether Bitget publishes arrangements for handling user assets and compensation; fourth, whether more independent institutions confirm or supplement the tracking results. In the absence of information from official and law enforcement levels, the incident remains at the follow-up tracking stage.
.jpg)
