THORChain Declines Bitget Request to Block Hacker as Stolen Funds Move to Bitcoin
Stolen Ether Swapped Despite Block Request
A wallet connected to the attacker behind a recent Bitget breach successfully converted approximately $6.3 million worth of ether into bitcoin using the THORChain network on Monday. This occurred even after the exchange publicly asked the decentralized swap protocol to block transactions from the hacker's known addresses.
Bitget suffered a security breach on September 24, resulting in the loss of about $388 million. Following the incident, the exchange identified specific wallet addresses used by the attacker and requested that THORChain refuse service to them. However, the network did not comply with this request.
Transaction Details and Volume
Analysis of public records on the THORChain network revealed 27 successful swaps. These transactions moved roughly 2,390 ether into 75.2 bitcoin. All the resulting bitcoin was sent to a single destination address. Additionally, four other swaps involving 400 ether were recorded as pending at the time of review.
The transactions took place between 03:55 and 06:23 UTC on Monday. Most of the orders were submitted in batches of about 100 ether, valued at approximately $265,000 each. Blockchain tracker Lookonchain had previously identified the Ethereum wallet as part of the attacker's activity.
Bitget's Call for Action
Following the breach, Bitget CEO Gracy Chen posted on X, stating that the attacker's addresses were publicly listed and actively tracked. She formally requested that THORChain refuse service to these specific addresses. The exchange also offered a 5 percent bounty for any efforts that successfully freeze or recover the stolen funds.
Bitget stated it had identified and fixed the vulnerability that allowed the attacker to bypass security controls, though it has not shared details on how the initial access was gained.
THORChain's Technical Limitations
THORChain operates as a decentralized network that allows users to exchange assets across different blockchains without needing an account at a centralized exchange. Because of this design, the network cannot selectively block individual addresses or freeze specific transactions.According to reports, THORChain's emergency controls are capable of halting broader network activity but lack the functionality to target a single user or transaction. This limitation prevented the network from complying with Bitget's request to block the hacker.
Tracking the Funds
While the swaps bypassed centralized exchanges that might have blocked the transfer, the transactions remain visible on the public ledger. This transparency allows investigators to follow the movement of funds across different networks. The attacker was able to move stolen ether and receive bitcoin in a separate wallet without passing through a third party that could intervene.
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.