Last night, I traced a TRON→Ethereum→TRON trail linked to the @Bitget incident and reported it to Bitget.
The portal confirmed receipt: 260926-030544-ZXB2.
I have since verified 20 anchors.
My provisional conservative attribution: 232,903.293115 USDT.
Evidence below.
Bitget publicly identifies TBWN… as a primary attacker-controlled TRON address: bitget.com/support/articles/…
It sent 722,717.515019 TRX to TKJZ…: tronscan.org/transaction/83f…
TKJZ… swapped 722,513.941829 TRX into 243,267.365292 USDT in three SunSwap transactions: tronscan.org/transaction/a39… tronscan.org/transaction/b32… tronscan.org/transaction/f05…
TKJZ’s USDT ledger has 3 swap receipts and 3 OFT sends totaling 243,267.365292 USDT: tronscan.org/address/TKJZQM7…
The 10,000-USDT side branch arrived on Ethereum as 9,997; I exclude it from the reported estimate. tronscan.org/transaction/fa7… etherscan.io/tx/0x098cf9ffe6…
Matching LayerZero OFT GUIDs connect two main bridge pairs: 100,000 USDT on TRON → 99,970 on ETH; 133,267.365292 → 133,227.385083. Event logs: tronscan.org/transaction/875… etherscan.io/tx/0x4f85a73fac… tronscan.org/transaction/39d… etherscan.io/tx/0x3d6a0e7e70…
The excluded 9,997-USDT side branch went out and returned through Chainflip as 9,996.706885 USDT. Its 0.293115 reduction is separate from the main route: etherscan.io/tx/0x7d4194dcbc… etherscan.io/tx/0x2eb04a542a…
The ETH wallet sent 243,194.091968 USDT back through LayerZero; 243,121.133741 arrived on TRON. The return OFT GUID matches: etherscan.io/tx/0x5b0891ce65… tronscan.org/transaction/b36…
TTVUv… then sent 23,551 + 66,229 + 153,213 = 242,993 USDT to TRzm… in three confirmed transactions; 128.133741 USDT remained at TTVUv…: tronscan.org/transaction/050… tronscan.org/transaction/84f… tronscan.org/transaction/4c4…
TRzm… sent 242,900 USDT to TSERwt…. The trail then continued TSERwt… → THCvq… → TMTYR…. Those later aggregate transfers contain mixed funds and are not added again: tronscan.org/transaction/234… tronscan.org/transaction/c6c… tronscan.org/transaction/f73…
Attribution model: 233,197.385083 − 72.958227 − 128.133741 − 93 = 232,903.293115 USDT.
This is my conservative estimate, pending Bitget validation.
⏩mastrlabs.com/services
Sep 26, 2026 · 9:51 AM UTC
5
14
81
4,617







