Blockchain analytics firm AMLBot says it traced approximately 4 BTC connected to the Bitget hack into Wasabi CoinJoin, a privacy-focused Bitcoin mixing service, underscoring the persistent difficulty of following illicit funds after a major exchange breach.

What AMLBot Traced

AMLBot, which describes itself as a crypto compliance and blockchain analytics platform, attributed the movement of roughly 4 BTC to wallet activity linked to the Bitget hack. According to the firm, on-chain Bitcoin transaction activity led to a Wasabi CoinJoin entry point, which it identified as the destination of the funds.

The ~4 BTC figure represents a portion of the broader hack proceeds rather than the total amount stolen. AMLBot's tracing claim has not been independently confirmed by a second on-chain analytics provider, and the firm's attribution methodology was not detailed in the report summary available at publication time.

Key details from the report:

• Reported amount: ~4 BTC traced by AMLBot
• Destination: Wasabi CoinJoin (Bitcoin privacy mixer)
• Explorer: Mempool.space for Bitcoin transaction verification
• Attribution: AMLBot — claim not yet independently corroborated

Bitget, a major centralized exchange, has expanded its product lineup in recent months, including a move into tokenized stocks. The hack stands as a separate and serious security incident, distinct from those business developments.

Why Wasabi CoinJoin Matters to the Trail

CoinJoin is a protocol that pools Bitcoin transactions from multiple users into a single transaction, making it harder to determine which input corresponds to which output. Wasabi Wallet is among the most widely used CoinJoin implementations and has appeared in prior investigations involving illicitly obtained Bitcoin.

When funds enter a CoinJoin round, the direct on-chain link between source and destination is obscured, though not entirely severed. Analytics firms rely on heuristics and graph analysis to follow funds through mixing rounds, but the process introduces significant uncertainty. AMLBot's ability to trace the roughly 4 BTC to Wasabi's entry point does not necessarily mean the firm can follow those funds beyond the mix itself.

This is not the first time stolen exchange funds have been routed through privacy tools. A prior episode involving large wallet movements tied to the Alameda/FTX estate demonstrated how labeled addresses can be monitored even years after a breach, though mixing complicates such monitoring considerably.

Implications for Crypto Compliance and Blockchain Analytics

AMLBot's report illustrates both the capability and the limits of modern blockchain forensics. Analytics platforms can identify fund movements and flag wallet clusters as suspicious, but tracing by itself does not prove theft, establish legal attribution, or guarantee asset recovery. Law enforcement agencies and exchange compliance teams treat such reports as investigative leads rather than conclusive evidence.

For exchanges monitoring outflows after a hack, the window before funds reach a mixer is the period when freezing at downstream platforms is most feasible. Once Bitcoin enters a CoinJoin round, coordinated action across multiple services would be required to intercept the outputs, and outcomes remain uncertain.

The episode also reinforces why Bitcoin's on-chain transparency cuts both ways: public ledgers make initial tracing possible, but privacy tools built on top of that ledger can partially offset that transparency. Compliance teams at exchanges and custodians increasingly treat CoinJoin outputs as elevated-risk inputs, flagging them for additional review whether or not a specific theft has been confirmed.

Whether the approximately 4 BTC can be linked to individual recipients after the mixing round depends on factors AMLBot has not publicly disclosed, including how many mixing rounds were completed and whether any outputs subsequently moved to identifiable exchange deposit addresses.

Additional source references: source document 1.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.