Bitget Hacker Swaps $6.3M ETH to BTC Via THORChain

CoinDesk traced 27 THORChain swaps converting 2,390 ETH into 75.2 BTC on Monday, even as the protocol refused to block the flagged wallets.

While Bitget's request to block attacker addresses sat rejected, the hacker kept moving. CoinDesk's analysis of THORChain's public transaction records found 27 successful swaps between roughly 03:55 and 06:23 UTC on Monday, exchanging about 2,390 ETH — around $6.3 million — for 75.2 BTC, with all bitcoin payouts going to a single address. Four additional swaps involving 400 ETH were still marked pending. Most orders were submitted in roughly 100 ETH batches worth about $265,000 each, and two 100 ETH orders were only partly filled after portions missed their minimum price, returning about 114 ETH to the sending wallet.

Bitget CEO Gracy Chen formally asked THORChain on September 26 to refuse service to the publicly tracked attacker addresses, writing that decentralization is 'a design principle, not a shield for facilitating known stolen funds.' THORChain answered on September 28 that a network halt is 'an emergency security mechanism designed to protect the protocol' and 'is not a selective freeze of specific funds or an individual swap,' comparing itself to Bitcoin, Ethereum and BNB Chain. The critical difference: THORChain can convert assets into bitcoin without identity checks, and once funds are bitcoin, no company can freeze them.

Protos reports that THORChain's own analytics page shows the protocol processed $678 million in the two days after the Bitget hack, against $20–60 million in daily volume the week before, generating almost $1.2 million in gross system income. According to The Market Periodical, MistTrack data ties the wallet to the Lazarus Group, sweeping ETH into BTC, and notes nearly $1.2 billion of the stolen Bybit funds was traced through THORChain after that $1.46 billion hack. A flagged XRP-to-Bitcoin swap also completed after Chen's appeal, Altcoin Buzz reports.

The refusal lands awkwardly given THORChain's own history. According to Protos, OKX founder Star Xu and security firm GoPlus Security argue THORChain's threshold-signature vaults give node operators pause mechanisms and per-chain halts that Bitcoin and Ethereum lack, while supporter Michael Perklin counters that threshold signing is automated and operators' only real choice is switching a node off. GoPlus urged the protocol not to 'enable criminals... just to take swap fees on stolen funds.'

Bitget raised its loss estimate from $351.6 million to roughly $387.5 million after tracing additional Zcash and TRON transactions, and has offered a 5% bounty for freezing or recovering stolen funds. The Cryptonomist reports Circle and Tether had frozen about $318,000 in USDC and USDT tied to the breach as of September 26 — progress only centralized issuers can deliver. Bitcoin withdrawals resumed September 28 as scheduled, with ETH set for September 29, USDT for September 30, and remaining tokens, fiat and P2P services on October 2, with Mandiant and SlowMist supporting the investigation.

The pattern suggests this fight will recur. MistTrack notes THORChain was the route for nearly $1.2 billion of the $1.46 billion Bybit haul, and Protos reports volume also spiked after April's $280 million Kelp DAO hack; a proposal to block the Bybit attacker failed to win node operator support and a core developer left the project. With the attacker still converting stolen assets into unfreezeable bitcoin, Bitget's recovery now depends on its bounty program, issuer freezes and exchange cooperation rather than any intervention at the swap layer — the price, as THORChain frames it, of staying permissionless.