A wallet linked to the attacker behind Bitget’s $387.5 million theft moved about $6.3 million in ether into bitcoin through THORChain on Monday, despite the exchange asking the cross-chain network to stop serving addresses associated with the breach.
According to CoinDesk, an analysis of THORChain’s public transaction records found 27 successful swaps involving approximately 2,390 ETH and 75.2 BTC. The bitcoin was sent to a single address. Four further swaps involving about 400 ETH were still marked as pending in the transaction data reviewed.
The activity took place between roughly 03:55 and 06:23 UTC on Monday. The orders came from an Ethereum wallet identified by blockchain tracker Lookonchain as linked to the attacker. Most of the transactions were submitted in batches of about 100 ETH, worth approximately $265,000 each based on the prices cited in the report.
How the funds moved
THORChain is a decentralised network that allows users to exchange digital assets native to different blockchains. Unlike a centralised crypto exchange, it does not require users to open an account on a single trading platform before swapping assets.
That structure can allow a user to send ether on the Ethereum network and receive bitcoin through a separate blockchain without passing through an exchange that might be able to stop the transaction. The activity is nevertheless recorded on public blockchains, enabling researchers to trace transfers and identify wallet movements.
The swaps were not all completed in full. Two 100-ETH orders were only partially filled after parts of the trades failed to meet the minimum price specified by the sender. About 114 ETH was returned to the wallet that submitted the orders.
Bitget said it lost about $388 million in a September 24 breach after an attacker bypassed security controls protecting the exchange’s wallets. The company has said it identified and fixed the vulnerability, but it has not publicly explained how the attacker obtained access.
Bitget seeks a selective block
Following the breach, Bitget published addresses it associated with the attacker and offered a bounty equal to 5% of eligible funds that could be frozen or recovered. As the stolen assets began moving through other services, Bitget chief executive Gracy Chen asked THORChain to reject transactions involving those addresses.
The request raised a central question for decentralised networks: whether a protocol designed to allow open access should intervene when funds are publicly linked to a reported theft. Bitget argued that decentralisation should not prevent a network from refusing to process known stolen assets.
THORChain rejected the request for an individual blacklist. It said its emergency controls are designed to protect the protocol as a whole and cannot be used to freeze a particular wallet or transaction selectively.
The network’s documented controls can halt swaps across all connected blockchains or restrict activity involving one chain, such as Ethereum. Either measure would affect other users whose transactions use the same routes, rather than isolating only the addresses identified by Bitget.
THORChain distinguishes emergency shutdowns
THORChain pointed to its handling of an earlier incident involving its own infrastructure. In May, an attacker took approximately $10.7 million from one of the network’s vaults, which hold assets used to facilitate swaps. Operators coordinated a shutdown while developers investigated and repaired the vulnerability, and trading resumed on June 22 after about five weeks.
The project said the addresses connected to that incident were never blacklisted. In its view, the May intervention addressed a compromised protocol, while Bitget’s current request concerns funds stolen from an external exchange.
The difference highlights the limits of emergency controls on a cross-chain network. A broad halt can interrupt activity to contain a threat to the protocol, but it does not provide a mechanism for freezing one user’s funds while allowing everyone else to continue trading normally.
Current crypto market picture
Moneyiar market data at the stated times puts Bitcoin at $83820.048202442, down 0.61% over 24 hours and up 3.2% over seven days as of 2026-09-25 22:04:00+03:30. Ethereum was at $2681.7028821295, down 0.13% over 24 hours and up 2.05% over seven days as of 2026-09-25 22:03:00+03:30.
THORChain’s RUNE token was priced at $0.6449452823, up 1.17% over 24 hours and 19.23% over seven days at the same stated Ethereum-data time. Request was at $0.0568780823, with a 24-hour gain of 0.87% and a seven-day gain of 6.55%. These market figures are separate from the transaction prices cited in the report and reflect Moneyiar data available at those times.
