An address linked to the attacker behind Bitget’s $387.5 million hack continued converting DAI, a dollar-pegged stablecoin, and bridging proceeds to Tron on October 1, according to MistTrack. The activity followed a week of rapid cross-chain movements involving stablecoins, bitcoin, ETH, XRP and Zcash. Circle and Tether froze about $318,000, or roughly 0.08% of Bitget’s disclosed loss, while NEAR Intents rejected more than $50 million in attempted swaps but froze about $503,000. THORChain declined Bitget’s request to block attacker-linked addresses because of its permissionless design. THORChain co-founder and lead developer Chad Barraford said asset recovery generally occurs at centralized exchanges and fiat off-ramps, where users must identify themselves, rather than at decentralized swap protocols. He said public transaction data lets investigators label and monitor stolen funds in near-real time, while THORChain’s emergency halt can stop activity across an entire network or chain but cannot selectively block one wallet. Bitget initially estimated the loss at $351.6 million on September 24 before raising it to about $387.5 million, while Barraford referred to the theft as involving more than $388 million. Bitget said its User Protection Fund had been restored to $309 million, including 3,705 BTC, and that customer balances were not reduced. Withdrawals resumed in phases, with remaining tokens, fiat and peer-to-peer services scheduled to reopen at 08:00 UTC on October 2. Key points to watch are the fund movements from a wallet holding 10,000 ETH, the continuation of the DAI-to-Tron flow and whether the final withdrawal phase opens as scheduled.