What Happened

A wallet tied to Bitget’s $388 million breach pushed $6.3 million in stolen ether through THORChain and out the other side as bitcoin this week, and a public request from the exchange to block the address did nothing to stop it. The episode is a live test of what a cross-chain swap network can and cannot do when an exchange asks it to freeze a specific wallet’s funds, and THORChain’s answer was that its emergency tools were never built for that job.

That distinction, between halting a protocol and blocking one address, is the actual story here. THORChain lets a user swap assets across separate blockchains without opening an account at a centralized venue, which meant ether tied to a known breach could convert into bitcoin without passing through any platform capable of blocking the transfer, according to SendTech Times.

Key Takeaways

  • A wallet linked to Bitget’s Sept. 24 breach converted about 2,390 ETH into 75.2 BTC across 27 swaps on THORChain, worth roughly $6.3 million.
  • The swaps ran between about 03:55 and 06:23 UTC Monday, mostly in 100 ETH batches worth about $265,000 each; four more swaps totaling 400 ETH were still pending when records were reviewed.
  • Bitget CEO Gracy Chen asked THORChain to refuse transactions from the identified addresses; THORChain said its emergency halt is a network-wide tool, not a selective freeze.
  • THORChain previously triggered a full network halt for roughly five weeks after a May exploit drained about $10.7 million from its own vaults, a precedent that protected the protocol rather than blocking one attacker.
  • Two of the attacker’s 100 ETH orders were only partly filled after missing their minimum-price settings, returning about 114 ETH to the sending wallet.

How the Wallet Moved Funds Without an Account

THORChain’s public transaction records show the mechanics plainly: 27 completed swaps exchanged about 2,390 ETH for 75.2 BTC, with every bitcoin payout landing at a single receiving address, according to SendTech Times. Blockchain tracker Lookonchain had already linked the sending Ethereum wallet to the attacker’s activity before Monday’s swaps began.

The orders ran from roughly 03:55 to 06:23 UTC, mostly in batches of about 100 ETH worth close to $265,000 apiece, per the same review. Four additional swaps covering 400 ETH remained pending at the time records were checked, separate from the 2,390 ETH already converted. Because THORChain requires no account and no identity check to initiate a swap, the attacker could move funds cross-chain without a platform in the path that could freeze the transaction before settlement. The trade-off, as CoinGape notes, is that the swaps stay fully visible on public blockchains, leaving a record that trackers and investigators can still follow after the fact.

Bitget’s Request and THORChain’s Refusal

Bitget’s exposure traces back to a Sept. 24 breach of its exchange wallets, which the company put at about $388 million, later saying it had identified and fixed the vulnerability without detailing how access was gained. Crypto News Digest reports Bitget subsequently raised its estimate of funds moved to attacker-controlled addresses to $387.5 million. The exchange published the attacker’s addresses and set a 5% reward for recovery or freeze efforts that qualify.

Over the weekend, Bitget CEO Gracy Chen asked THORChain directly to refuse service to those addresses. “Decentralization is a design principle, not a shield for facilitating known stolen funds,” she wrote, according to Crypto News Digest. THORChain rejected the request on Monday, stating that its network halt is an emergency tool for protecting the protocol as a whole and “is not a selective freeze of specific funds or an individual swap.” The controls it does have are broad: a full network halt across every connected chain, or a restriction limited to one chain, such as Ethereum, either of which would also interrupt other users’ transactions on the same paths.

What the Controls Actually Cover

THORChain’s account of its own limits is contested. Security firm GoPlus pushed back on that framing, pointing to validator votes, signing controls, and chain-specific pauses described in THORChain’s own documentation as mechanisms that could theoretically let node operators intervene, per Crypto News Digest. THORChain has maintained its position that emergency halt powers protect the network itself rather than serving as a blocklist for particular funds.

The May precedent supports THORChain’s version of events more than it undercuts it. Operators halted the network after about $10.7 million was drained from one of its own swap-liquidity vaults, and developers investigated and repaired the vulnerability before trading resumed on June 22, roughly five weeks later, per SendTech Times. That halt addressed a threat to the protocol’s own liquidity, not a specific bad actor’s wallet, which is the same line THORChain is drawing now.

Monday’s records also show the attacker didn’t get every trade through cleanly. Two orders of 100 ETH were only partly filled because portions missed their minimum-price settings, sending about 114 ETH back to the originating wallet, according to SendTech Times. That’s a slippage constraint built into how swaps execute, not an intervention against the address, and it illustrates the gap between protocol-level mechanics and the targeted freeze Bitget wanted.

What to Watch

The four pending swaps covering 400 ETH had not cleared at the time records were reviewed, and their outcome will show whether the remaining funds follow the same path. Crypto News Digest also reports that compliance firm AMLBot separately traced about 4 BTC tied to a Bitget-associated TRON wallet into a Wasabi CoinJoin round on Sept. 27, after funds moved from TRON to Ethereum and then through THORChain, a mixing step that complicates matching senders to receivers. Bitget’s 5% bounty for recovery or freeze efforts remains open, and the disagreement between THORChain and GoPlus over what the network’s validator and signing controls can actually do is unresolved.

Sources