Bitcoin went back to Ethereum. Then to DAI. Then to TRON.
On 30 Sep, Bitget's stolen BTC took a U-turn back to Ethereum through the same naswap storefront. From there it went into DAI and across a bridge to TRON. It ended as 1.2M USDD on a wallet one day old, in a stablecoin no issuer can freeze. Meanwhile, $14M of Zcash went dark.
by @REKTCOON · on-chain only · every claim links to dataThe U-turn, hop by hop
In Part 1 we listed the BTC addresses where Bitget's ETH landed after THORChain. The second biggest was bc1qqmp67f…kau7h, which received 1,436 ETH worth of BTC. On 30 Sep part of that Bitcoin came back.
- Part 1 BTC address → new wallet
bc1qqmp67f0xu7q624u8k9w9tlc0y65ayffrqkau7h consolidates 12 inputs into bc1qcxy08hw79xfy8pty3nmnz5hnzfj0tlvgxaymce: 2.23 BTC. mempool ↗
- BTC → ETH, through naswap
Four THORChain swaps, 2.243 BTC → 69.34 ETH, each memo ending :naswap:30. That's the same storefront from Part 3, now working in reverse. Midgard ↗
- Lands on a known laundering wallet
The ETH goes to 0x4a777646417b0Fd34715d2b21d4a132c06AEd330, an intermediate we flagged in Part 1. Since 27 Sep it has moved 9,299 ETH, including 5,145 ETH from Exploiter 4 and 2,500 ETH from Exploiters 12 and 13. Etherscan ↗
- Out to a fresh wallet
475 ETH (75 + 200 + 200.3) to 0x8b9c04Fe94B60FC45ac026EA9d00b0f1DAf77125. Within minutes, poisoning bots spam it from look-alike 0x8b9c… addresses.
- ETH → DAI on CoW Swap
484 ETH sold through CoW Swap's ETH-flow for 1,275,162 DAI. Unlike USDT and USDC, DAI has no freeze function. (On 29 Sep, 26,600 USDT went out the same way.) Etherscan ↗
- Split across 5 fresh wallets
425,094 DAI → 0x4e86db1e…c423 · 311,866 → 0xb208b8ea…e4f0 · 481,770 → 0xa21c85c9…6eb8 (281,720 of it on to 0xf4987a78…78d9) · 56,302 → 0x70f3c153…5841
- DAI → USDT → bridge to TRON
Four of them swap DAI to USDT on Uniswap v4 and sends it straight into the USDT0 bridge (LayerZero OFT 0x1f748c76…dfb0). The decoded send() calls carry dstEid 30420, which is TRON.
- USDT → USDD within seconds
On TRON the USDT lands on wallets created the same day (TSjHkJLGQ1X5VzkCMtUSKu1ka5UvC6sfRD, TL7KHYRRnTkm95PJxSRY2ikRN3iBr7BL95, TQbYDeshPjxsDGuTn5cS9KutrtmMp26GDu, TG5BnDRPd1EvTHMUcR1djfoKxu3MwJNgBn). It's swapped to USDD through a SunSwap router, usually within a minute of arrival. Tether had seconds, at most a few minutes, to act on each deposit.
- Parked: 1,200,000 USDD
All four send their USDD to TUddQsNe3fRonEER4JbuWjSnfM1nmwqxhF, created at 13:13 UTC that day. It holds exactly 1,200,000.06 USDD and has not moved since. Tronscan ↗
This is a fresh, single-purpose TRON wallet. Bitget's tracker independently lists it as an attacker TRON downstream wallet and marks the balance not freezable. USDD is pegged to the dollar, but it has no Tether-style blacklist. The next move from this wallet, to an exchange, an OTC desk or another bridge, is the one that matters.
Why go back?
Breaking the trail
Every jump between chains and assets adds a step for an analyst to link. BTC → ETH → DAI → USDT → USDT0 → USDD crosses three chains and five assets in about 20 hours. Each swap goes through a different venue: THORChain, CoW Swap, Uniswap v4, LayerZero and SunSwap.
Picking what can't be frozen
USDT is used only as a bridge token, for about a minute at each end. The money rests in DAI on Ethereum and in USDD on TRON, stablecoins without an issuer freeze. This is the lesson from the first 21 minutes, when the attacker dumped USDT and USDC before Tether and Circle could act.
A Bitcoin hub mixing old and new
naswap kept selling the other direction too. 69 naswap swaps from Bitget laundering wallet 0x1cdac13e…ddb7 (29 Sep 06:51 → 30 Sep 08:14) all paid out to one Bitcoin address, 38mHJzN9v3b9brRsCMZexCbEsekcmR4rwi. Every one of the 14.55 BTC it ever received came from those swaps.
It forwards round amounts (1.0, 1.23, 1.67 BTC…) to bc1qcucpas769r9rfpah0fv89wtqnsjgl63keycaj7. That hub has received 88.3 BTC so far. In the same blocks, the hub is also fed by bc1qle6cq42zs5uur72hl2n5raghyyyux0c0g26edr, a wallet that already received THORChain payouts in April–May 2025 and that we flagged to Bitget on 28 Sep as pre-existing infrastructure. From the hub, BTC leaves in round lots to fresh addresses. Bitget's tracker logged its latest 2 BTC move at 01:33 UTC today.
$19.4M into mixers in a day
The main ZEC address dropped from 18,581 to 8,582.56 ZEC (Blockchair, 1 Oct). Bitget's tracker counts 9,260 ZEC (~$14.4M) as entering the shielded pool across 32 transfers. Media reported 2,746 ZEC on 30 Sep; the real figure is now more than three times that.
The tracker counts 33 CoinJoin entries totaling 60.05 BTC (~$5.1M). Yesterday the whole mixer figure was $3.94M. Now it is $19.45M.
The fee wallet went from 138,320.64 to 139,140.58 RUNE, exactly the fees from five naswap swaps on 30 Sep: the four U-turn swaps and one on the 38mHJz… route. Still no cash-out. Lead filed with Bitget, ref ····2HSJ.
Where the $387.5M is now
| Bucket (Bitget tracker, 1 Oct 02:23 UTC) | USD | vs 30 Sep |
|---|---|---|
| Held in attacker addresses, mostly 4,019.8 BTC | $362.3M | −$12.7M |
| Mixers: ZEC shielded pool + BTC CoinJoin | $19.45M | +$15.5M |
| Swap/bridge losses (fees, slippage) | $3.54M | − |
| Services: NEAR Intents, StealthEX, OTC, Chainflip deposits sent to the wrong chain and stuck (~$698K) | $1.39M | new |
| In flight | $0.60M | |
| Frozen | $0.34M | |
| On exchanges (incl. the OKX deposit we reported) | $0.21M |
Source: trace.bgblockchain.xyz. Bitget changed its bucket definitions between snapshots, so the deltas are indicative.
How, and what we don't claim
- naswap swaps from THORChain Midgard (affiliate=naswap); BTC inputs and spends from mempool.space.
- ETH and token flows from Blockscout; the poisoning spam (fake DAI/USDT/ETH tokens and look-alike senders) is excluded. Only the canonical DAI and USDT contracts are counted.
- Bridge destinations decoded from USDT0 OFT send() calldata: dstEid 30420 (TRON), and the recipient bytes32 converted to TRON base58.
- TRON transfers from TronGrid; ZEC balance from Blockchair; buckets from Bitget's public tracker.
- Who controls any of these wallets. We name no person.
- That CoW Swap, Uniswap, LayerZero/USDT0, SunSwap or THORChain acted knowingly.
- That USDD can or cannot be frozen by any party. We report what Bitget's tracker states.
- Exact amounts inside the Zcash shielded pool, which are hidden by design.