Bitget hacker THORChain swaps moved approximately $6.3 million in ETH to BTC. The wallet associated with the Bitget attacker used THORChain for the transfers.
The activity occurred amid a request from Bitget CEO Gracy Chen. She asked the decentralized network to block addresses tied to the September 24 breach.
Bitget hacker THORChain swaps 2,390 ETH into Bitcoin
According to blockchain data, the wallet made 27 swaps on Monday. In total, about 2,390 ETH were traded for roughly 75.2 BTC. Only one receiving address got the Bitcoin.
At the time of review, another 400 ETH were waiting in four transactions. The activity ran from about 03:55 to 06:23 UTC. Most orders were for roughly 100 ETH. Each batch cost about $265,000 at current prices.
Lookonchain previously flagged the wallet as part of the attacker’s operations.
THORChain defends its decentralized model
THORChain lets users move assets between blockchains without a centralized exchange. Therefore, halting a transaction becomes harder once stolen funds enter the system. The swaps remain on-chain nevertheless. This lets researchers trace the funds.
Bitget suffered a breach on September 24. Nearly $352 million was stolen. The exchange says it found and patched the vulnerability. It has not revealed how the attacker breached its security.
Bitget also shared attacker addresses. It declared a 5% bounty for freezing or recovering stolen funds.
Over the weekend, Chen publicly called on THORChain. She wrote on X: “Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses.” She added: “Decentralization is a design principle, not a shield for facilitating known stolen funds.”
THORChain denied the targeted freeze request. The network said its emergency controls are not meant to block specific wallets. Instead, they protect the protocol itself. “A THORChain network halt is an emergency security mechanism,” the team wrote. “A halt is not a selective freeze of specific funds or an individual swap.”
THORChain can suspend swaps across the network. It can also limit activity on a specific blockchain. However, this would affect legitimate users too.
The network previously halted after an exploit. That incident took about $10.7 million from its own vaults. Trading restarted on June 22 after developers fixed the vulnerability.
Trading limits also affected the hacker’s wallet. Some 100 ETH orders were not fully filled. Minimum price requirements caused this. About 114 ETH returned to the sending wallet.
