Roughly 4 BTC linked to the Bitget security breach entered a Wasabi CoinJoin round after moving from TRON through USDT0, Ethereum and THORChain. AMLBot said the route involved converting TRX into USDT, bridging the funds to Ethereum through USDT0, swapping them into about 145 ETH and converting the ETH into roughly 4.59 BTC before splitting the Bitcoin across addresses. The firm linked the CoinJoin inputs to a Bitget-associated TRON wallet, blacklisted related addresses and is monitoring for further activity. Bitget revised the value transferred to attacker-controlled addresses to approximately $387.5 million, up from $351.6 million after additional Zcash and TRON assets were included. AMLBot estimated that about $343.2 million, or 88.1% of roughly $389.4 million tracked, remained dormant across 13 attacker wallets. Bitget said the underlying vulnerability was fixed and plans to resume withdrawals gradually from September 28 with Bitcoin, followed by broader restoration through October 2.