Investigation into Bitget Fund Laundering
In a deep dive into the laundering of funds stolen from Bitget, independent researcher Andrey Sergeenkov reported that the protocols and services facilitating this illicit transfer amassed significant fees, totaling $761,725. The investigation also identified that $259,718 in THORChain affiliate fees were linked to recipients with possible connections to the wallets implicated in the swaps. The researcher’s findings, which covered transactions up to October 2, indicated the complexity of the laundering scheme following the theft reported on September 24, which Bitget estimated at $387.5 million.
Distribution of Laundered Funds
From the swaps involving the misappropriated funds, it was revealed that THORChain liquidity providers received the lion’s share of $573,226. Additionally, MetaMask accrued $149,417, Chainflip received $26,751, and CoW EthFlow accounted for $12,332, illustrating the varied services profiting from these transactions.
Analysis of Affiliate Fees
Sergeenkov’s analysis extended beyond just identifying these services; he meticulously examined THORChain affiliate fees, tracking the movement of funds and establishing links between certain addresses and the stolen assets. Notably, he stumbled upon a total of $259,718 in affiliate fees allocated to seven addresses that exhibited subsequent financial activity with wallets involved in the stolen fund swaps. However, Sergeenkov clarified that the presence of an address in this category does not necessarily implicate it as belonging to the attacker, as recipient addresses can be manipulated in transactions.
From those affiliate fee recipients, the most substantial was an address that collected $177,499, further analyzed against shared wallet movements tied to the laundering efforts. Other recipients also revealed connections, with amounts such as $56,514 and $18,080, indicating a network of transactions perhaps aimed at concealing the origins of the funds. The analysis also noted that several swaps involving different affiliate recipients ultimately directed the principal stolen assets to the same Bitcoin wallets.
Tracking the Funds
Furthermore, part of the funds from the aforementioned address was tracked beyond THORChain, reaching an Ethereum address designated as “OKX Hot Wallet 5”, suggesting a possible path to further concealment. Sergeenkov mentioned that OKX could potentially utilize its deposit logs to verify if those movements corresponded to any client account, although his work does not assert any account ownership or connection to the initial heist.
Post-Breach Activity
The investigation sheds light on the evolution of the stolen assets post-Bitget breach, which saw approximately $269 million traversing through THORChain, representing extensive use of the protocol with significant transaction activity. Following the theft, one wallet linked to Bitget executed 27 THORChain swaps that converted a large Ethereum amount into Bitcoin, amounting to an estimated $6.3 million at that time.
Additionally, the study highlighted a separate batch of THORChain affiliate recipients, who collectively gathered $206,196 from the swaps, yet lacked the connections found in the previously mentioned group. The largest in this cohort was tied to the name naswap and garnered $102,344, while a holding account attributed to various labels received $92,438.
Ongoing Debates and Conclusions
The findings surfaced amid ongoing debates between Bitget and THORChain concerning the protocol’s role in blocking transactions linked to the funds’ misappropriation. While Bitget pressed for proactive measures, THORChain asserted its mechanisms were not intended for selective transaction freezes. In contrast, NEAR Intents reported successfully blocking attempted transfers exceeding $50 million connected to the Bitget wallets, halting several transactions worth around $503,000 during their execution.
Sergeenkov’s findings emphasize the substantial fees accumulated during the laundering of stolen assets without indicating any recovery efforts or funds frozen. His research highlights the complex web of financial transactions and services involved in moving the stolen funds, raising crucial questions about accountability and the role of various services in crypto asset management.
