Some funds suspected of being stolen in the Bitget hacking incident may have begun passing through Wasabi CoinJoin, a transaction-mixing process. AMLBot said the funds initially came from a Bitget TRON wallet, where the attacker converted TRX into USDT before moving it cross-chain through USDT0 to Ethereum. The assets were exchanged for about 145 ETH and later converted through THORChain into about 4.59 BTC. The BTC was then divided and preprocessed before entering CoinJoin, which is designed to obscure links between transaction inputs and outputs.