Bitget Hacker Moves $6.3 Million Through THORChain As Freeze Request Fails
A wallet tied to Bitget’s $388 million breach converted about $6.3 million in ether into bitcoin through THORChain, exposing the limits of selective freezes on open swap networks.
About $6.3 million tied to the Bitget breach moved from ether into bitcoin through THORChain on Monday, CoinDesk found, setting up a public clash between an exchange trying to freeze stolen funds and a swap network built to stay open.
The transaction trail gives the dispute a concrete shape.
THORChain's public records showed 27 successful swaps that exchanged about 2,390 ETH for 75.2 BTC, with all bitcoin payouts landing at one address.
Four more swaps involving 400 ETH were still marked pending in the response reviewed.
The orders ran between about 03:55 and 06:23 UTC from an Ethereum wallet that blockchain tracker Lookonchain had linked to the attacker's activity.
Most arrived in roughly 100 ETH batches, each worth about $265,000 at those prices.
The route mattered because THORChain lets users swap assets across blockchains without opening an account at a centralized exchange.
In this case, ether associated with a known breach could be converted into bitcoin without passing through a platform that might block the transfer.
The movements remained visible on-chain, leaving investigators a record to follow even as the assets shifted networks.
Bitget's loss began with a Sept. 24 breach of exchange wallets.
The company put the damage at about $388 million and later said it had identified and fixed the vulnerability, without publicly detailing how access was gained.
Bitget also made the attacker addresses public and set a 5% reward for qualifying recovery or freeze efforts.
As the movement continued, Bitget CEO Gracy Chen asked THORChain over the weekend to refuse service to those addresses, writing that decentralization should not become "a shield" for known stolen funds.
THORChain's answer drew a line between protecting the protocol itself and blocking a user's assets for an outside victim.
The project defended open network access on Monday and argued that its emergency halt controls are not designed as a selective address blocklist.
Those controls are broad rather than surgical.
THORChain documentation describes settings that can stop swaps across every connected blockchain or limit activity involving a particular chain, such as Ethereum.
Either route would affect other users on the same paths, not only the funds Bitget wanted stopped.
The distinction was tested earlier this year.
In May, THORChain operators stopped the network after one of its own swap-liquidity vaults was drained of about $10.7 million.
Developers investigated and repaired that vulnerability before trading resumed June 22 after roughly five weeks.
Monday's records also showed limits in the attacker's path.
Two orders of 100 ETH did not clear in full because parts of the trades missed their minimum-price settings, sending about 114 ETH back to the originating wallet.
The episode leaves Bitget with public tracking and recovery incentives rather than a guaranteed network-level block.
THORChain's position remained that emergency shutdown powers protect the protocol as a whole rather than freezing one account or one swap.
