AMLBot traces Bitget-linked BTC into Wasabi CoinJoin after Thorchain hop
By Crypto Wire
September 26, 2026
On-chain analytics firm AMLBot says some Bitget-linked stolen funds have started entering Wasabi CoinJoin mixing rounds, TechFlow, PANews, TokenPost, Wu Blockchain, and Binance Square / Odaily wraps reported into September 27 UTC. Trackers put roughly 4 BTC in one CoinJoin round as still traceable back to a Bitget TRON wallet after a multi-hop path that ends in bitcoin mixing. Attribute the mixer claim, the ~4 BTC CoinJoin print, and the hop sequence to AMLBot via those desks—do not invent that every Bitget-stolen bitcoin has already mixed.
The attributed route is concrete enough for Rug Room readers. AMLBot’s tracking, as carried by TechFlow and PANews, starts at a Bitget TRON wallet where TRX was swapped for USDT, then bridged toward Ethereum via USDT0, exchanged for about 145 ETH, converted through Thorchain into about 4.59 BTC, split, and funneled into CoinJoin—leaving about 4 BTC still linkable in one mixing round. TokenPost’s Saturday evening pass matches that ladder and notes related addresses have been blacklisted while further CoinJoin activity tied to attacker BTC is monitored. Treat every hop dollar and ticker print as attributed analytics, not a complete public ledger of the ~$387.5 million haul.
Why CoinJoin matters after Thorchain. Wasabi-style CoinJoin combines many users’ bitcoin inputs into collaborative transactions so individual trails are harder to follow once funds leave the round. AMLBot’s claim that Bitget-linked BTC has begun that step is the unused laundering-path update: after days of Thorchain swap color and CEO refuse-service fights, a named mixer round is a new recovery obstacle for exchanges, stablecoin issuers, and chain-analytics desks watching the same attacker cluster.
What this post is not. LN 9790 covered Bitget CEO Gracy Chen’s Thorchain refuse-service ask and the protocol’s permissionless reply. LN 9798 covered OKX founder Star Xu’s TSS-intermediary critique. LN 9786 and LN 9776 filed Binance ETH refuel and unfreezable XRP moves. LN 9755 already logged the phased withdrawal reopen and the 07:30 UTC September 28 AMA. Today’s unused angle is AMLBot’s Wasabi CoinJoin hop after the TRON→USDT0→ETH→Thorchain→BTC path.
Recovery context stays thin and attributed. Bitget still pegs the incident near $387.5 million after adding Zcash and TRON assets to the first ~$351.6 million print, runs dual 5% freeze and recovery bounties, and stages withdrawals from September 28. TokenPost notes some attacker-linked addresses have also been frozen elsewhere, without publishing a full recovered-dollar scoreboard in the mixer wrap. AMLBot’s blacklist and continued CoinJoin monitoring are investigator claims—not proof the mixer round is blocked for every subsequent hop.
How collectors and traders should read a ~4 BTC mixer print without overclaiming. Four bitcoin is a small slice of a hundreds-of-millions haul, but CoinJoin is designed to break simple address clustering after Thorchain already converted ETH into BTC. For NFT desks watching Bitget-adjacent settlement risk, the practical signal is that attacker BTC is moving into privacy tooling that exchanges cannot “refuse service” to the way a DEX front end or a stablecoin issuer can freeze a tagged wallet. Attribute that limitation as desk analysis of AMLBot’s path, not as a claim every stolen asset will mix.
Rejected near-echos for this tick. Thorchain refuse-service ask/reply is LN 9790. Star Xu TSS critique is LN 9798. Solana above $120 is LN 9796. Withdrawal reopen calendar plus Chen AMA slot is LN 9755. Phygital desk 59 remains unused—no fresh vaulted-collectible catalyst cleared the last-6-hours bar beyond recycled CryptoSlam Courtyard rankings adjacent to LN 9769.
Why Rug Room 52 plus Latest News 16 (no Editor’s Pick—Sep 26 OC EP already 5/5). An overnight AMLBot Wasabi CoinJoin trail on Bitget-linked BTC after Thorchain conversion is unused exploit-aftermath laundering tape distinct from the CEO ask and Star Xu governance desks. Author is Crypto Wire for desk 52. Publicize stays off.
What not to invent: that AMLBot audited the full $387.5 million into CoinJoin, a precise Wasabi round ID beyond attributed desk language, that Thorchain validators approved the BTC swap, or that Bitget has already recovered the mixed ~4 BTC. Stick to AMLBot / TechFlow / PANews / TokenPost / Wu Blockchain attributions for the hop path and mixer claim.
Bottom line: AMLBot traces about 4 BTC of Bitget-linked loot into Wasabi CoinJoin after a TRON→ETH→Thorchain path—unused Rug Room news for Sep 26 OC.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
