We matched the Bitget hackers' Zcash exits to their Bitcoin again on 5 October, and this time they did half the work for us: they undid their own coinjoin and typed a Bitcoin address in CAPITALS again.
The drain.
We read the shielded pool transactions at the raw level and watched the drain go in: their listed main Zcash wallet emptied 8,582 ZEC ($11.3m) into the pool in 29 chained sends between 06:32 and 12:37 UTC, to five wallets that each shielded within minutes.
One fresh wallet shielded 0.1 ZEC ($132) as a test before its two 335 ZEC ($442k) slices, and we had seen that wallet before: they gave it as the refund address on two swaps on 30 September, five days before it existed on chain. Fresh money in the pool since 30 September: 18,581 ZEC ($24.5m).
Out through THORChain.
The pool hides which entry became which exit, so we ran our own census of every exit and matched them by the fingerprint in how their wallet builds a transaction. One wallet stood out, first seen by us on 3 October, t1f4d9KVnE…: fourteen exits in their build, 3,455 ZEC ($4.56m). We decoded the memos on its 28 THORChain deposits: every one named the same Bitcoin address, which Bitget already lists as the hackers'. THORChain refunded 17 of the 28, so 1,320 ZEC ($1.74m) went through, and on 5 October 19.69 BTC ($1.68m) landed there. It also paid 2,319 ZEC ($3.06m) into the hackers' now listed shielding wallet, in round amounts.
The un-mix.
Ten of their swap-group addresses moved 14.48 BTC ($1.24m), three coins straight into WabiSabi coinjoin rounds. Four hours later they spent the mixed coins with their own: one transaction, 33 inputs, one output. A coinjoin hides whose coin is whose, but 33 inputs spent into one output share one signer, and five of them are the group's own coins, so the 23 freshly mixed outputs are theirs too.
The mix is undone for 3.0 BTC ($256k), at 07:50:16 UTC in block 969,979:
f7464e6abe6fbde7abdc64a63366514324a9be535cdc38812d0ad4bc89976afb
The hoard.
Their listed Bitcoin hoard split into four parcels of 5, 5, 10 and 9.53 BTC, 29.53 BTC ($2.52m) in all, the last in the same block as the un-mix.
The capitals are back: thirteen more swaps on 5 October had the Bitcoin recipient typed in CAPITALS, the tell from the 1 October run. 661.96 ZEC ($874,146) out, 8.57 BTC ($731,431) paid.
Three swaps they placed at NEAR Intents failed or stalled, and their 300 ZEC ($396k) deposit is held there.
Tonight: 43.91 BTC ($3.75m) parked by the swap group and 81.34 ETH ($219,503) at the end of the NFT launder leg. We filed ten new addresses with Bitget, the THORChain wallet among them.
Every address and hash:
yfarmx.com/bitget-postmortem…