Bitget Hacker Converts $6.3 Million in ETH to BTC After THORChain Rejects Freeze Request

The Bitget breach underscores the ongoing risks in cryptocurrency exchanges and the limitations of decentralized protocols in responding to theft.

• On September 28, 2026, a wallet linked to the Bitget breach converted approximately $6.3 million in ETH to 75.2 BTC via THORChain.
• THORChain rejected Bitget's request to block the identified attacker addresses, citing its inability to selectively freeze transactions.
• Bitget's loss estimate has risen to $387.5 million, prompting a phased reopening of withdrawals and a 5% recovery bounty program.

• The breach occurred on September 24, 2026, resulting in unauthorized transfers from Bitget's hot wallets.
• THORChain is a decentralized liquidity protocol that enables cross-chain swaps without centralized control, complicating recovery efforts.
• Bitget has engaged investigators and launched a bounty program to recover stolen funds while resuming withdrawals.

On September 28, 2026, an Ethereum wallet associated with the Bitget attacker executed 27 swap orders through THORChain, converting approximately 2,390 ETH into 75.2 BTC. This conversion was part of a broader scheme following a significant breach at Bitget, which had initially reported losses of $351.6 million, later revised to $387.5 million after including additional assets like Zcash and TRON.

The breach prompted Bitget CEO Gracy Chen to publicly request that THORChain block transactions from the identified attacker addresses. However, THORChain declined this request, stating that its emergency controls are designed for network-wide halts rather than targeted freezes. This limitation highlights a critical challenge in decentralized finance: while it offers increased security and autonomy, it also lacks the responsive measures that centralized systems can implement in crisis situations.

The 27 swaps were executed between approximately 03:55 and 06:23 UTC, with all BTC routed to a single receiving address. Earlier, the hacker had also routed around 4 BTC through Wasabi CoinJoin, a privacy-focused service, further complicating tracking efforts. Bitget's phased reopening of withdrawals began with Bitcoin on the same day as the swaps, indicating a cautious approach to restoring user confidence.

The incident has broader implications for the cryptocurrency market, particularly regarding the security of exchanges and the effectiveness of decentralized protocols in preventing or mitigating theft. As exchanges like Bitget engage in recovery efforts, the response from decentralized platforms like THORChain will be closely scrutinized. The ongoing tracking of stolen funds by firms such as AMLBot and Lookonchain suggests that while the immediate threat may have been managed, the long-term implications for user trust and regulatory scrutiny remain significant.

• Cryptocurrency traders: Increased scrutiny on exchange security may affect trading strategies and asset choices.
• Investors in decentralized finance: Concerns about the reliability of decentralized protocols could lead to a reevaluation of investment in such platforms.
• Regulatory bodies: Heightened awareness of security vulnerabilities may prompt new regulations in the cryptocurrency space.

• Recovery efforts: Monitor how effective Bitget's bounty program is in recovering stolen funds and restoring user confidence.
• Regulatory responses: Watch for potential regulatory changes aimed at enhancing security protocols for exchanges and decentralized platforms.
• Market reactions: Observe how this incident influences trading volumes and user behavior on affected platforms.