A wallet connected to the Bitget hacker converted roughly $6.3 million in ether into bitcoin through THORChain on Monday, according to CoinDesk's analysis of the protocol's public transaction records. The analysis identified 27 successful swaps exchanging about 2,390 ETH for 75.2 BTC, with all bitcoin payouts directed to a single address.
The swaps originated from an Ethereum wallet that blockchain tracker Lookonchain identified as part of the attacker's activity. Orders were submitted between approximately 03:55 and 06:23 UTC on Monday, mostly in roughly 100 ETH batches worth approximately $265,000 each. Four additional swaps involving 400 ETH were marked pending.
Exchange Seeks Network Intervention
Bitget, which suffered a breach on September 24 resulting in approximately $388 million in losses, had previously published attacker addresses and offered a 5% bounty for efforts to freeze or recover stolen funds. Over the weekend, Bitget CEO Gracy Chen publicly called on THORChain to refuse transactions from these addresses, writing that "decentralization is a design principle, not a shield for facilitating known stolen funds."
THORChain's Policy on Selective Blocking
THORChain rejected the request, stating that its emergency controls cannot freeze individual addresses or transactions. In a Monday response, the protocol distinguished between its emergency shutdown capabilities and selective address blocking. "A THORChain network halt is an emergency security mechanism designed to protect the protocol," the project wrote. "A halt is not a selective freeze of specific funds or an individual swap."
THORChain's operators can interrupt trading across all connected blockchains or restrict activity on particular chains such as Ethereum, but such measures would also affect other users' transactions on those routes, the project explained.
Protocol's Cross-Chain Design
THORChain allows users to exchange assets across different blockchains without opening accounts at centralized exchanges, enabling attackers to convert stolen assets across networks without passing through traditional exchanges that could block transfers. The swaps remain publicly visible, allowing investigators to track fund movements across chains.
Historical Precedent
THORChain previously used emergency controls in May following a $10.7 million theft from one of its own vaults. Operators coordinated a network shutdown while developers investigated and repaired the vulnerability. Trading resumed on June 22 after approximately five weeks. The project noted that the May attacker's addresses were never blacklisted, distinguishing that intervention—which addressed a compromised protocol—from Bitget's request regarding externally stolen funds.
Monday's swap records also showed the attacker encountering trading limits, with two 100 ETH orders only partially filled after portions failed to meet specified minimum prices, returning approximately 114 ETH to the sending wallet.
