THORChain rejects Bitget request to block hacker as $6 million moves to bitcoin

A wallet tied to the attacker in a Sept. 24 breach of crypto exchange Bitget swapped about 2,390 ETH (roughly $6.3 million) for 75.2 BTC through THORChain on Monday, according to CoinDesk’s review of THORChain records. Bitget had asked THORChain to block addresses associated with the $387.5 million theft, but THORChain declined to selectively blacklist individual wallets, citing its emergency controls as non-selective protections.

By AI Newsroom· Reviewed by Pranav, Founder & Editor-in-ChiefPublished 1 minute agoUpdated 1 minute ago0 views

THORChain rejects Bitget request to block hacker as $6 million moves to bitcoin

Why It Matters

The incident highlights tensions between centralized exchanges seeking to freeze stolen funds and decentralized cross-chain protocols that lack address-specific freeze mechanisms — complicating recovery efforts after major crypto breaches. It also illustrates how cross-chain swaps can move large stolen balances into assets such as bitcoin while remaining publicly traceable on-chain.

Key Facts

Date of swaps: Submitted between ~03:55 and 06:23 UTC on Monday (Sep. 28, 2026)
Ether swapped: About 2,390 ETH (~$6.3 million)
Bitcoin received: 75.2 BTC
Number of successful swaps: 27 successful swaps
Additional pending swaps: Four swaps involving ~400 ETH marked pending in the records reviewed

CoinDesk’s examination of THORChain’s public transaction ledger found that a wallet identified by blockchain tracker Lookonchain as linked to the attacker in Bitget’s Sept. 24 breach executed 27 successful cross-chain swaps, converting roughly 2,390 ether into about 75.2 bitcoin. The orders were mostly submitted in batches close to 100 ETH each, and all bitcoin payouts were sent to a single destination address. Four further swap attempts, totaling around 400 ETH, appeared as pending in the reviewed records.

Bitget, which has said it lost about $388 million in the breach, published addresses it tied to the attacker and offered a 5% bounty for efforts that freeze or recover stolen funds. The exchange’s CEO, Gracy Chen, publicly requested that THORChain refuse service to the listed attacker addresses, arguing decentralization should not serve as a shield for moving stolen assets.

THORChain responded by defending its policy of allowing permissionless access and by distinguishing its emergency network halt capability from a selective address freeze. The project team said its emergency controls can stop swaps across affected chains or halt the network entirely, but they cannot target a single address or transaction without disrupting other users’ activity on those routes. THORChain previously used a full halt in May after an internal exploit that led to about $10.7 million being taken from a vault; the network resumed trading after fixes were implemented.

The swap records also show the attacker ran into execution limits: two 100 ETH orders were only partially filled because parts failed to meet minimum price conditions, with roughly 114 ETH returned to the sender. While THORChain enables cross-chain conversion without routing funds through centralized exchanges that might block transfers, its on-chain records remain public and can be followed by investigators tracking stolen funds across networks.