TLDR
Stolen Ether (ETH) from the recent Bitget hack is being converted into Bitcoin (BTC) through the THORChain cross-chain DEX, making recovery harder and raising fresh questions about protocol responsibility.
- On-chain trackers show a Bitget hack-linked wallet moving hundreds of millions in ETH into THORChain and swapping it for BTC.
- Hackers are using permissionless cross-chain swaps and later obfuscation tools to reduce freeze risk and complicate tracing.
- Bitget says user balances are covered and withdrawals are resuming, while regulators and security firms focus on THORChain and similar infrastructure.
Confidence: high based on consistent on-chain traces and multiple independent news reports.
Deep Dive
1. What Is Moving On-Chain
Bitget suffered a major breach on 24 Sep, with initial loss estimates around $351.6 million, later raised to about $387.5 million as more attacker wallets were linked to the incident. Reports and on-chain analysis show a key wallet associated with the hack sending ETH in batches to THORChain vaults and rapidly swapping into BTC, often in 100 ETH increments.
TokenPost highlights that Bitget hack-linked Ether is being swapped for Bitcoin through THORChain, valuing the affected assets at around $351.6 million on the day of the observed flows. Lookonchains on-chain trace further links the activity to address 0xf7bC9, showing ETH routed through THORChain and out as BTC.
A substantial share of the stolen ETH is already being repositioned into BTC via a decentralized cross-chain path, which reduces the chances of simple centralized freezes.
2. Why Use THORChain And Similar DEXes
THORChain lets users swap assets across blockchains without an account or KYC, acting as a cross-chain DEX rather than a mixer. Once stolen ETH becomes BTC on-chain, there is no central party that can freeze those coins directly.
Bitget publicly asked THORChain to block the attacker wallets, but THORChain refused, citing its permissionless design and comparing its role to base networks like Bitcoin and Ethereum. This stance and its history of being used to route earlier large hacks have sparked debate over whether decentralized protocols should intervene when dealing with clearly stolen funds.
Cross-chain DEXes are attractive to hackers because they offer liquidity and path flexibility with limited direct censorship, so tracing and law-enforcement coordination become more important than expecting the protocol itself to block flows.
3. Effect On Bitget Users And Market Risk
Bitget states that its User Protection Fund, holding hundreds of millions of dollars equivalent, will fully cover customer balances despite the breach, and it has begun phased withdrawal resumption starting with BTC, then ETH, USDT, and other assets over several days. Crypto.news reports that cold wallets and private keys were not compromised, and that external security firms are helping trace and recover funds.
At the same time, the visible use of THORChain and similar bridges in this and past hacks is drawing attention from regulators and security researchers, who are questioning how to handle large illicit flows that rely on permissionless infrastructure. This could lead to tighter scrutiny on cross-chain services, heightened due diligence expectations, and possibly more aggressive tracking of flows from known exploit addresses.
Bitget account holders are likely shielded by the protection fund, but the broader market faces rising operational risk around cross-chain protocols, so watching exchange security notices and large on-chain flows is increasingly important.
Conclusion
Hack-linked ETH being swapped into BTC via THORChain shows how modern attackers use cross-chain DEX liquidity to launder large exploits while staying outside centralized controls. For ordinary users, the immediate impact is mitigated by Bitgets protection commitments, but the incident underscores that security, tracing, and the rules around permissionless protocols are becoming central to crypto market stability.
CoinsKid.Com