MistTrack🕵️ (@MistTrack_io)
@MistTrack_io
0 正在关注 0 粉丝
🔎 The @bitget exploiter is moving stolen DAI on Ethereum through a series of swaps and cross-chain transfers:
DAI → USDT on Ethereum → USDT0 → Tron
💱 One recent transaction:
100,000 DAI → 100,034.89 USDT via #Uniswap#.
🌉 The USDT was then transferred from Ethereum to Tron via #USDT0# infrastructure.
USDT0 OFT:
0x1f748c76de468e9d11bd340fa9d5cbadf315dfb0
Tron-side USDT0 OFT:
0x3a08f76772e200653bb55c2a92998daca62e0e97
On Tron, the funds continued moving via #SunSwap#:
• 90,967 USDT → $USDD
• 19,000 USDT → $TRX
This activity is part of an ongoing flow from an address linked to the Bitget exploiter. The same address has been repeatedly converting $DAI to $USDT and bridging the funds to #Tron#.
We’ll continue tracking the movement of the stolen funds across chains and services. 👀
显示更多
🔎 MistTrack TrackAgent spotted a notable cross-chain pattern in the movement of funds stolen from Bitget: Using a CoW Protocol + Chainflip combination to automate cross-chain transfers.
The flow:
1) An automated script creates an order on #CoWProtocol#.
2) The order’s recipient is set to a pre-prepared #Chainflip# Deposit Contract address.
3) Once the order is executed, the assets enter Chainflip and are swapped across chains into BTC.
⤵️ One example:
Create Order on CoW Protocol:
Order execution:
Chainflip Deposit Contract:
0xcEAE932A8bEE3a81a681A59890cb26d3110FDb65
Chainflip swap:
Destination BTC address:
bc1qa0rjjhyu9pg3adgpel4v7dct6a8606az863jyh
The interesting part is the automation: rather than manually interacting with each bridge or swap, the attacker can prepare the destination and let the flow execute once the order is filled.
We’ll continue tracking how the stolen funds move across chains and services. 👀
显示更多
我们的 @MistTrack_io TrackAgent 发现朝鲜黑客采用 Cow Protocol + Chainflip 组合跨链操作：Bitget 被盗资金，朝鲜黑客自动化脚本通过 Cow Protocol 创建订单，订单收款地址设置为预先准备好的 Chainflip Deposit 相关合约地址，订单成功后即可完成在 Chainflip 的资产跨链操作，换成 BTC。
如这笔：
在 CoW Protocol 上创建订单：
订单成交：
收款地址（即 Chainflip Deposit Contract）：
0xcEAE932A8bEE3a81a681A59890cb26d3110FDb65
对应 Chainflip 记录：
跨链资产到 BTC 地址：
bc1qa0rjjhyu9pg3adgpel4v7dct6a8606az863jyh
@MistTrack_io @SlowMist_Team
显示更多
The @bitget exploiter tried to move the stolen funds through @Chainflip.
Chainflip’s response?
“Deposit rejected by the broker.” 👋
No freeze, but no luck either — the funds were refunded. 👍
Nice try. 😶
We’ll continue tracking the movement of the stolen funds.
🔗
显示更多
Tether banned the wallet owned by the bitget exploiter
So far, we have identified the following addresses associated with the @bitget exploiter that still hold funds. We will continue to update this list. @GracyBitget @xiejiayinBitget @Bitget_zh
显示更多
THORChain and Stolen Funds: The Industry Needs Answers
After the $1.46B @Bybit_Official hack last year, nearly $1.2B in stolen funds was reportedly traced through @THORChain as the attackers moved assets across chains.
Today, following another major security incident at @Bitget , we are once again observing Bitget Exploiter funds being sent into the THORChain for asset swaps and cross-chain transfers.
The question is no longer:
“Does THORChain know these funds are associated with hackers?”
The attacker addresses have already been publicly flagged and are being actively tracked by exchanges, blockchain security/aml firms, and the wider crypto industry.
The real question is:
When a protocol is aware that funds originate from a publicly identified major hack, yet continues to facilitate large-scale cross-chain swaps, how should the industry view this under the banner of “decentralization”?
Decentralization should not become a blanket excuse when dealing with known stolen funds.
If, after every major crypto hack, attackers can continue using THORChain as a route to move funds from ETH → BTC, BNB → BTC, and across other chains, the industry needs to seriously ask:
What responsibility should THORChain bear when handling known stolen funds?
@GracyBitget @xiejiayinBitget @benbybit
显示更多
So far, we have identified the following addresses associated with the @bitget exploiter that still hold funds. We will continue to update this list. @GracyBitget @xiejiayinBitget @Bitget_zh
显示更多
All hacker addresses have been tagged. We’re actively monitoring fund transfers and expanding our blacklist. We remain fully committed to combating illicit transactions.
[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026
At 18:31 UTC on September 24, 2026, Bitget's security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately.
What we have confirmed:
-Estimated funds affected: approximately $351.6 million
-Cold wallets remain fully secure. Bitget operates a three-tier wallet architecture — the breach contained only a portion of the hot wallet and warm wallet layers.
-User funds are safe. The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million
Actions we have taken:
-Emergency response team activated within minutes of detection
-Abnormal transfer addresses identified, flagged, and reported
-Withdrawals temporarily suspended as a precautionary measure, pending security review
-Law enforcement and on-chain security firms have been formally notified and are engaged
What this means for you:
-Your account balances are accurate and your assets are protected
-Deposits and trading remain fully operational
Withdrawals are temporarily paused and will be restored as soon as the security review is complete
-What comes next: We will provide updates on an hourly basis across this channel and all official platforms. A full incident report — including root cause analysis and corrective actions — will be published within 24 hours. We will not speculate on the attack vector until the investigation is complete.
Bitget has navigated multiple market cycles. We will not run from this. Every dollar and every decision will be accounted for, transparently and in full.
Updates will be posted here and across all official Bitget channels as they become available.
— Gracy Chen, CEO, Bitget
显示更多
🚀MistTrack Crypto AML x402 API is now live!
To make address analysis more convenient, we have launched the MistTrack Crypto AML x402 API, supporting blockchain address labeling and risk detection.
🌟A boon for AI Agents and developers:
No registration required, no API Key needed. Simply call the API on-demand through the x402 payment protocol — flexible and efficient!
💰Address labels start at just $0.10 per call
🛡️Full suite of features including Risk Scoring, Transaction Investigation, and more
⚡Perfectly suited for AI Agent automation workflows
Try it now👇
显示更多
🚨 MistTrack Illicit Fund Analysis — Taiko Exploit 🕵️
On June 22, 2026, the Taiko protocol was exploited. Stolen funds were distributed across multiple attacker-controlled addresses.
The main attacker EOA 0x7506DeA0c38ca0B55364B22424374c5A1ae1B76a received various ERC-20 tokens (USDC, USDT, crvUSD, CRV, WBTC, wEETH, TAIKO, iZi) and quickly swapped most non-native assets for ETH via DEXs, accumulating ~615 ETH. Separately, 277.97 ETH was bridged out directly.
Total stolen: ≈ $1.74M (at incident-time prices).
✅ 777.977 ETH (~$1.35M) moved to:
0xa98035081fb739ebe9c8f80904668fb11438a846
✅ 1.99M TAIKO (~$194K) deposited to MEXC via:
0x5FBc60A12Bc6635E7d587d8DaC52e4b1388b4990
⚠️ Attacker EOA still holds: 117 ETH + 2.14M iZi + 0.531 wEETH
Key address to monitor:
0xa98035081fb739ebe9c8f80904668fb11438a846
We have blacklisted the related addresses and are actively monitoring them.
显示更多
