On-chain investigator SomaXBT stated that the Bitget attacker used an exchange service that relies on Binance, such as an OTC (over-the-counter) service or an instant conversion service, to convert approximately 2.6 million stolen TIA from the Celestia network into assets on the Ethereum mainnet, and emphasized that the related funds were not sourced from Binance. Their tracking shows that about 2.607 million TIA were exchanged via this service for 257.63 ETH and approximately 545,000 USDT. The USDT was then converted into roughly 200.17 ETH, and ultimately about 457.90 ETH was transferred to the attacker’s main ETH collection address.