Bitget Hacker Moves $6.3 Million Into Bitcoin After THORChain Rejects Freeze Request

A wallet linked to the Bitget hacker has swapped about $6.3 million in ETH for Bitcoin through THORChain after the network rejected the exchange’s request to block addresses tied to its Sep. 24 breach.

According to CoinDesk’s review of THORChain transaction records, the 27 completed swaps sent all 75.2 BTC to one receiving address. The orders came from an Ethereum wallet that blockchain tracker Lookonchain had identified as part of the attacker’s activity. Four more transactions involving a combined 400 ETH were pending when CoinDesk reviewed the records.

Bitget-linked wallet converts ETH in 27 swaps

Submitted between roughly 03:55 and 06:23 UTC on Monday, most of the orders involved about 100 ETH apiece. CoinDesk valued each batch at approximately $265,000 at the prices used in its review. The completed transactions exchanged roughly 2,390 ETH for 75.2 BTC; the pending 400 ETH was separate from that total.

The records also showed limits on what the wallet could exchange at its chosen prices. Two orders of 100 ETH were only partly filled because portions did not meet the minimum price set for the trade. About 114 ETH was returned to the sending wallet, according to CoinDesk’s review.

THORChain allows a user to exchange assets held on different blockchains without sending them through a centralized exchange. In Monday’s transactions, ETH entered the swap network, and BTC went to an address on the Bitcoin network. Both sides of the transfer remain visible on public blockchains, leaving investigators able to follow the recorded movements even though the assets changed chains.

A separate route had already put Bitget-linked Bitcoin into a privacy transaction. On Sep. 27, blockchain compliance firm AMLBot traced about four BTC into a Wasabi CoinJoin round after funds moved from TRON to Ethereum and then through THORChain. AMLBot said its tracing linked the Bitcoin to a Bitget-associated TRON wallet. CoinJoin combines inputs and outputs from multiple users in one transaction, making a direct match between them harder to establish.

THORChain says a halt cannot target one address

Bitget CEO Gracy Chen asked THORChain over the weekend to refuse service to addresses the exchange had published and was tracking. In her X post, she argued that the network should act on the identified funds:

“Decentralization is a design principle, not a shield for facilitating known stolen funds.”

THORChain rejected the request for an address-specific block. In its public response, the team said a network halt is an emergency tool for protecting the protocol and “is not a selective freeze of specific funds or an individual swap.” Its controls can stop swaps across the network or restrict activity on a connected blockchain, according to the team, but either action would also interrupt transactions from other users.

Security firm GoPlus has challenged THORChain’s account of its available controls. As reported on Sep. 27, the firm pointed to validator votes, signing controls, and chain-specific pauses described in THORChain’s documentation. GoPlus argued that those mechanisms give node operators ways to intervene when funds are at risk. THORChain maintains that its emergency halt protects the network itself and does not serve as a blocklist for particular wallets.

The network used its emergency controls after an attacker took about $10.7 million from a THORChain vault in May. Operators stopped activity while developers repaired the vulnerability, and trading resumed in June after roughly five weeks. THORChain said the May attacker’s addresses were not individually blacklisted.

Bitget raises breach estimate and offers recovery rewards

Bitget first valued the assets affected by the Sep. 24 breach at approximately $351.6 million. After accounting for Zcash and TRON assets omitted from its initial calculation, the exchange raised the value transferred to attacker-controlled addresses to about $387.5 million. Bitget said the increase came from a fuller review of the original incident, rather than additional theft after the breach.

The exchange detected unauthorized transfers at 18:31 UTC on Sep. 24 and suspended withdrawals while it investigated. Bitget said its cold wallets remained secure. Its later update said investigators had found and fixed the vulnerability, while Mandiant and SlowMist were assisting with the investigation and security checks. Bitget has not released a complete public account of how the attacker entered its systems.

Chen subsequently announced a recovery bounty program with separate 5% rewards for eligible efforts that freeze stolen assets and recover them. Bitget published primary attacker addresses across Ethereum-compatible networks, XRP Ledger, Zcash and TRON, along with a tracing dashboard for further movements. The exchange said it would decide eligibility and payments based on each participant’s contribution; work carried out under a court order or law enforcement request does not qualify for the bounty.

For U.S. readers, the recovery effort includes Circle, the U.S.-based issuer of USDC. Bitget said Circle had frozen 99,990 USDC tied to the attack, while Tether had frozen 218,023 USDT. Those token freezes concerned identified stablecoin balances; THORChain’s response addressed Bitget’s separate request to stop ETH-to-BTC swaps. Bitget has also discussed a future U.S. business, with Chen saying in July that it would seek licenses and approvals before offering services to Americans.

Bitcoin withdrawals lead Bitget’s staged reopening

Bitget set out a phased withdrawal schedule after the security checks. Under the published timetable, Bitcoin withdrawals on the Bitcoin network were due to reopen at 08:00 UTC on Sep. 28. ETH withdrawals across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism were scheduled for the same time on Sep. 29.

The schedule placed USDT withdrawals on Ethereum, BNB Smart Chain, Solana and TRON at 08:00 UTC on Sep. 30. Bitget assigned other tokens, fiat services and peer-to-peer transactions to a final stage scheduled for Oct. 2. The exchange told customers to check its official notices for confirmation that each service was available.