Bitget Hacker Transfers $6.3 Million to Bitcoin Despite THORChain’s Freeze Request being Denied

A wallet associated with the Bitget hacker has converted approximately $6.3 million in ETH to Bitcoin via THORChain, after the network denied the exchange’s request to block addresses linked to its breach on September 24.

As per CoinDesk’s analysis of THORChain transaction data, all 75.2 BTC from the 27 swaps were sent to a single address. These transactions originated from an Ethereum wallet that blockchain tracker Lookonchain had identified as part of the attacker’s operation, with four additional transactions involving a total of 400 ETH still pending during CoinDesk’s review.

Bitget-linked wallet converts ETH in 27 swaps

Executed between approximately 03:55 and 06:23 UTC on Monday, the majority of these orders were for around 100 ETH each. CoinDesk estimated each batch to be worth about $265,000 based on the prices at the time of review. The completed transactions swapped an estimated 2,390 ETH for 75.2 BTC, while the 400 ETH pending was separate from this total.

The data also indicated limitations on the wallet’s ability to exchange assets at the desired prices. Two orders for 100 ETH were only partially filled due to portions not meeting the minimum price for the trade, resulting in approximately 114 ETH being returned to the original wallet, as noted in CoinDesk’s analysis.

THORChain enables users to swap assets from different blockchains without going through a centralized exchange. In the transactions completed on Monday, ETH entered the swap network while BTC was sent to a receiving address on the Bitcoin blockchain. Both aspects of the transfer can be tracked on public blockchains, allowing investigators to trace these movements, despite the assets changing chains.

Another route had already linked Bitget-associated Bitcoin into a privacy transaction. On September 27, blockchain compliance company AMLBot traced approximately four BTC into a Wasabi CoinJoin round after the funds moved from TRON to Ethereum and then through THORChain. AMLBot indicated that its tracing connected the Bitcoin to a TRON wallet affiliated with Bitget. CoinJoin combines inputs and outputs from multiple users into a single transaction, making it more challenging to establish direct links.

THORChain says a halt cannot target one address

Bitget CEO Gracy Chen requested THORChain over the weekend to deny service to addresses published by the exchange that it was monitoring. In her post on X, she argued that the network should act on the flagged funds:

“Decentralization is a design principle, not a shield for facilitating known stolen funds.”

THORChain declined the address-specific blocking request. In its public reply, the team clarified that a network halt is an emergency measure aimed at protecting the protocol and “is not a selective freeze of specific funds or individual swaps.” Their controls can halt all swaps across the network or limit operations on a connected blockchain, but either action would also disrupt transactions for other users.

The security firm GoPlus has questioned THORChain’s description of its available controls. As reported on September 27, the firm pointed to validator votes, signing controls, and chain-specific pauses outlined in THORChain’s documentation. GoPlus contended that these mechanisms provide node operators opportunities to intervene when funds are in jeopardy. THORChain maintains that its emergency halt is intended to protect the network itself rather than serve as a blacklist for particular wallets.

The network implemented its emergency controls after a hacker stole about $10.7 million from a THORChain vault in May. Operators halted activity while developers fixed the security flaw, and trading resumed in June after about five weeks. THORChain stated that the addresses linked to the May attacker were not individually blacklisted.

Bitget raises breach estimate and offers recovery rewards

Initially, Bitget estimated the assets impacted by the September 24 breach at around $351.6 million. Following a thorough review that included Zcash and TRON assets that were left out of the original assessment, the exchange increased the value transferred to addresses controlled by the attacker to roughly $387.5 million. Bitget attributed this increase to a more comprehensive examination of the initial event, rather than any additional theft following the breach.

The exchange detected unauthorized transfers at 18:31 UTC on September 24 and suspended withdrawals while it conducted an investigation. Bitget confirmed that its cold wallets remained secure. An update stated that the vulnerability had been identified and rectified, with Mandiant and SlowMist aiding in the investigation and security assessments. Bitget has not disclosed a complete public account of the methods utilized by the attacker to infiltrate its systems.

Chen later announced a recovery bounty program, offering 5% rewards for eligible efforts to freeze and reclaim stolen assets. Bitget published the primary addresses of the attacker across Ethereum-compatible networks, XRP Ledger, Zcash, and TRON, alongside a tracing dashboard for tracking further movements. The exchange indicated that it would determine eligibility and rewards based on each participant’s contribution; activities conducted under a court order or law enforcement request would not qualify for the bounty.

For readers in the U.S., the recovery initiative includes Circle, the U.S.-based issuer of USDC. Bitget mentioned that Circle had frozen 99,990 USDC associated with the attack, while Tether had frozen 218,023 USDT. These token freezes related to identified stablecoin balances; THORChain’s response addressed Bitget’s separate request to halt ETH-to-BTC swaps. They have also discussed plans for a future U.S. business, with Chen stating in July that Bitget would seek licensing and approval before offering services to American users.

Bitcoin withdrawals lead Bitget’s staged reopening

Bitget outlined a phased withdrawal schedule following security reviews. According to the timetable, Bitcoin withdrawals on the Bitcoin network were scheduled to reopen at 08:00 UTC on September 28. ETH withdrawals across Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism were set to commence at the same time on September 29.

The schedule included USDT withdrawals on Ethereum, BNB Smart Chain, Solana, and TRON at 08:00 UTC on September 30. Bitget assigned other tokens, fiat services, and peer-to-peer transactions to a final stage set for October 2. The exchange urged customers to monitor its official announcements for confirmation of the availability of each service.