TL;DR
Get hardware and tech essentials delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A wallet identified by blockchain tracker Lookonchain as linked to the Bitget hacker swapped about 2,390 ETH, worth $6.3 million, for 75.2 BTC through THORChain on Monday. THORChain rejected Bitget’s request to block identified addresses, saying its emergency controls can halt broader activity but cannot selectively freeze a wallet or transaction.
A wallet linked by blockchain tracker Lookonchain to the September 24 Bitget breach swapped about 2,390 ether, worth $6.3 million, for 75.2 bitcoin through THORChain on Monday, September 28. THORChain rejected Bitget’s request to block publicly identified attacker addresses, saying the network cannot freeze individual wallets or transactions.
CoinDesk’s analysis of THORChain’s public transaction records found 27 swaps marked successful, with all 75.2 bitcoin payouts going to one address. The orders were submitted from an Ethereum wallet identified by Lookonchain as part of the attacker’s activity between about 03:55 and 06:23 UTC. Most were placed in batches of roughly 100 ETH, then worth about $265,000 each. Four more swaps involving 400 ETH were marked pending in the response CoinDesk reviewed.
Bitget said it lost about $388 million in the September 24 breach and has offered a 5% bounty for eligible efforts to freeze or recover the stolen assets. CEO Gracy Chen asked THORChain over the weekend to refuse transactions from listed addresses. The exchange said it had identified and fixed the vulnerability, but has not publicly explained how the attacker gained access.
THORChain said its emergency controls can stop swaps across all connected chains or limit activity involving a specific chain, such as Ethereum. Those measures would affect other users’ transactions on the routes they cover. The project said the controls do not let it single out an address or individual swap for a freeze.
Why Cross-Chain Swaps Matter
The transactions show how assets can move between blockchains without passing through a centralized exchange. THORChain allows users to swap assets across networks without opening an account at a conventional exchange, where a company might be able to block a withdrawal or deposit. In this case, the wallet sent in ether and received bitcoin at another address.
The swaps’ visibility gives investigators a public record to follow, but that does not by itself establish who controls the receiving address or whether the funds can be recovered. The episode also puts a practical limit on Bitget’s request: THORChain says it can interrupt activity broadly, but does not offer the targeted address freeze the exchange sought. A wider halt could also disrupt transactions by people unrelated to the breach.
Top picks for "thorchain reject bitget"
As an affiliate, we earn on qualifying purchases.
Bitget’s Request and THORChain’s Controls
After the breach, Bitget published addresses it identified as belonging to the attacker and announced a 5% bounty for eligible work to freeze or recover the stolen funds. Chen’s public request urged THORChain to refuse service to those addresses. She argued on X that decentralization should not shield the facilitation of transactions involving funds identified as stolen.
THORChain pointed to its May response to an exploit of its own vaults, the accounts that hold assets used in swaps. The project said operators coordinated an emergency shutdown after about $10.7 million was stolen, while developers investigated and repaired the vulnerability. Trading resumed on June 22 after roughly five weeks. THORChain said the May attacker’s addresses were not blacklisted; that shutdown addressed a compromised protocol rather than a request to freeze funds stolen from an outside exchange.
The Monday records also showed two 100 ETH orders only partly filled after portions failed to meet their specified minimum price. About 114 ETH was returned to the sending wallet, according to CoinDesk’s review. The reported successful swaps therefore should not be read as a complete accounting of every order submitted.
““Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses.””
— Bitget CEO Gracy Chen, in a post on X
What the Transaction Records Cannot Show
The public records show how much ether was submitted through the reviewed swaps and where the bitcoin payouts went, but they do not independently establish who controls the receiving address or whether the assets remain there. Four swaps involving 400 ETH were marked pending in the response CoinDesk reviewed, and the cited reporting does not establish their eventual outcome.
Bitget has not publicly detailed how the attacker bypassed its exchange-wallet security controls. The available information also does not establish whether any of the funds have been frozen or recovered, or whether the 5% bounty has led to a recovery. Lookonchain’s identification links the sending wallet to the attacker’s activity; the transaction records alone do not prove the identity of the person controlling it.
Recovery Efforts and Network Activity
Bitget’s stated offer remains a 5% bounty for eligible freezing or recovery efforts, while THORChain has said it will not selectively block individual addresses or swaps. Any use of the network’s emergency controls would affect broader swap activity on the routes covered by a halt, according to the project’s explanation.
Further public transaction records may show whether the pending orders completed and how the bitcoin moves afterward. The available report does not give a timeline for additional action by Bitget or THORChain, nor does it confirm a recovery. Cryptoasset prices and transactions can be volatile, and losses are possible; this report describes the incident and does not provide investment advice.
Key Questions
How much did the wallet swap through THORChain?
CoinDesk identified 27 swaps marked successful, exchanging about 2,390 ETH, valued at $6.3 million in the report, for 75.2 BTC. Four additional swaps involving 400 ETH were marked pending in the reviewed response.
Why did THORChain reject Bitget’s request?
THORChain said its controls can halt swaps across all connected chains or restrict activity on a particular chain, but cannot selectively freeze an individual address or transaction. A broader halt would also interrupt other users’ swaps on the affected routes.
What happened in the Bitget breach?
Bitget said it lost about $388 million on September 24, 2026, after an attacker bypassed security controls protecting exchange wallets. The company said it had identified and fixed the vulnerability but had not publicly described how access was gained.
Have the stolen funds been recovered?
The cited report does not confirm a recovery or a freeze. The public transaction records show the swaps and bitcoin payout address, but do not establish who controls that address or the funds’ current status.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
