Major Exchange hack funds move through DEX

TLDR

Funds stolen from the Bitget exchange hack are actively being moved and swapped through decentralized protocols, especially THORChain, rather than traditional centralized venues.

1. Bitget suffered a roughly $387.5 million security breach, and on-chain data shows the attacker routing stolen ETH, XRP and other assets into BTC via THORChain.
2. Bitget asked THORChain to block hacker addresses, but THORChain refused, citing its permissionless design, which highlights the tension between decentralization and stopping stolen funds.
3. Investigators and issuers have frozen some stablecoins, but most hacked funds are still in motion through bridges, mixers and DEX routes, keeping recovery and market impact uncertain.

Deep Dive

1. How The Hack Funds Are Moving

Bitget reported a large wallet compromise, initially estimated at $351.6 million and later revised to about $387.5 million, affecting ETH, XRP, stablecoins and other assets across multiple chains, including Ethereum, TRON and Avalanche, as detailed in exchange and media reports.

Follow-up coverage shows attacker-linked ETH being sent in batches to THORChain vaults and swapped into BTC, with earlier flows of XRP, BNB and TRX also routed through THORChain and similar services, according to on-chain tracking summaries.

Separately, investigators like ZachXBT report that parts of the stolen funds are being moved through cross-chain bridges and deposited into mixers such as Wasabi to further obscure their trail.

2. Decentralization Versus Blocking Stolen Funds

Bitgets CEO publicly asked THORChain to refuse service to known hacker addresses, arguing that decentralization should not shield stolen funds, as reported in crypto coverage of the dispute.

THORChain responded that, while it can halt the entire network or specific chain routes in emergencies, it will not selectively block individual addresses, consistent with its permissionless design, a stance echoed in technical explanations.

This clash highlights a core trade-off: protocols designed for censorship resistance are much harder to use as tools for law-enforcement-style asset freezes, even when funds are clearly stolen.

3. Recovery Efforts And User Impact

Bitget is resuming withdrawals in phases and says its User Protection Fund, reportedly over $464 million, will fully cover customer balances despite the theft, according to recent status updates.

Stablecoin issuers like Circle and Tether have already frozen some USDC and USDT tied to the attack, but most hacked assets moved into BTC or through mixers remain in circulation, with tracing and legal recovery ongoing.

Risk note: interacting with liquidity tied to publicly flagged hacker addresses can expose users to later freezes or investigations if those funds are identified and targeted.

Conclusion

The Bitget incident shows how large exchange hacks now quickly spill into DeFi and cross-chain infrastructure, with THORChain and similar protocols used to convert and route stolen funds. That reinforces both the strength and the downside of permissionless designs: they preserve open access, but they make stopping known stolen assets difficult, leaving centralized exchanges, issuers and investigators to rely on tracing, targeted freezes and user protection funds rather than direct protocol-level censorship.