Key Insights
- Bitget hack addresses used THORChain for cross-chain swaps as investigators traced funds from the $387.5 million breach.
- THORChain said emergency network halts protect protocol security and cannot selectively freeze identified wallet addresses.
- Bitget began restoring Bitcoin withdrawals on Sept. 28 after remediating the wallet-infrastructure vulnerability.
Attacker-linked wallets originating from the Bitget security breach utilized THORChain to transfer stolen assets across different blockchains. Although Bitget requested that the protocol reject transactions tied to these flagged addresses, THORChain upheld its permissionless framework.
Bitget’s updated estimates indicate that roughly $387.5 million landed in hacker-controlled addresses during the Sept. 24 event, an upward revision from its initial $351.6 million figure.
Bitget Hacker Is Exploiting THORChain to Convert User Funds
On-chain intelligence reveals that the perpetrator behind the $351 million Bitget attack is leveraging THORChain. Data from Arkham Intelligence shows the hacker address—believed to be linked to the notorious North Korean Lazarus Group—has converted Ethereum (ETH) into Bitcoin (BTC).
As previously detailed, the assailant stole 34,890 ETH valued at $85 million from the platform, making it the second-largest cryptocurrency taken from Bitget in terms of value, trailing only XRP.
On Friday, September 25, MistTrack reported that the thief is exploiting the THORChain network to launder the stolen capital via asset swaps and cross-chain transfers. “After the $1.46B Bybit hack last year, nearly $1.2B in stolen funds was reportedly traced through THORChain, as the attackers moved assets across chain,” they noted.
While these attacker-associated addresses are publicly known and actively monitored by AML firms, blockchain security providers, and exchanges, MistTrack argued that THORChain must accept accountability and avoid serving as a primary laundering hub for hackers.
Commenting on the situation, BitGet CEO Gracy Chen stated: “Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses. Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching.”
THORChain Defends Its Stance on Not Blocking Hacker Addresses
THORChain explained that network halts serve strictly as emergency security measures to safeguard the protocol, maintaining that they cannot be deployed as tools to selectively freeze specific funds or block individual swaps.
The protocol pointed to a May 2026 exploit that drained $10.7 million from its liquidity pools, noting that the attackers’ addresses were not blacklisted at the time and thus retained the ability to execute swaps on the network.
“THORChain is permissionless and doesn’t censor by design,” the protocol stated in a message published on the X platform.
Several industry figures have backed THORChain’s position. Digital nomad Michael Perkins remarked, “All tools in existence are inherently neutral by nature. It is the man who wields the tool that decides whether they will use it for good or for bad, and you cannot blame tools for the actions of men.”
Bitget Resumes Bitcoin Withdrawals
Adhering to its planned schedule, crypto exchange Bitget resumed platform withdrawals beginning today, September 28. The exchange confirmed that the vulnerability has been fixed and that no additional unauthorized transfers have occurred since containment.
Furthermore, Bitget emphasized that user assets remain secure. CEO Gracy Chen previously announced intentions to rebuild the exchange’s Protection Fund back to its $300 million baseline within one week.
According to updates from the X account “Ai,” Bitget moved 2,042.28 BTC—valued at approximately $169 million—from its approximately 5,500 BTC Protection Fund into hot wallets, while another 3,457.72 BTC stays on-chain.
She clarified that these movements were executed ahead of time and should not be misconstrued as actual user withdrawal volume.
This article is for informational purposes only. Blockchain labels and analytics do not independently establish the identity of wallet controllers.