TLDR
- An address connected to the Bitget breach exchanged approximately 2,390 ETH (valued at $6.3 million) for 75.2 BTC via THORChain this Monday.
- The Bitget platform suffered a security breach on September 24, resulting in approximately $387.5 million in losses after attackers circumvented security measures.
- Bitget’s CEO Gracy Chen made a public appeal to THORChain requesting the platform block the attacker’s wallet addresses, emphasizing the need for responsibility.
- THORChain declined the request, stating it maintains neutrality across all users similar to how Bitcoin and Ethereum operate, without implementing selective account freezes.
- In May 2026, THORChain halted operations following a $10.7 million exploit of its treasury, though officials maintain this differs from blocking externally stolen assets.
The cryptocurrency exchange platform Bitget experienced a major security compromise resulting in approximately $387.5 million in losses when an attacker penetrated its infrastructure on September 24. In the aftermath, the misappropriated assets have been transferred across various blockchain networks, with one particular transaction chain now drawing significant scrutiny.
This Monday, a cryptocurrency wallet associated with the perpetrator executed a conversion of approximately 2,390 ether tokens, valued at roughly $6.3 million, receiving 75.2 bitcoin in exchange. This cross-chain transaction was facilitated through the THORChain protocol.
THORChain operates as a decentralized liquidity protocol enabling users to exchange different cryptocurrency assets without relying on centralized intermediaries such as traditional financial institutions or custodial exchanges. The platform requires no identity verification or account registration.
CoinDesk examined the publicly available blockchain transaction data from THORChain’s network. The analysis identified 27 completed swap transactions. These operations converted approximately 2,390 ETH into 75.2 BTC, with the entire bitcoin amount being directed to one destination wallet.
An additional four transactions involving 400 ETH remained in pending status at the time of reporting. The majority of exchanges were executed in increments of approximately 100 ETH each, representing roughly $265,000 per transaction.
Bitget Requests THORChain Intervention
The wallet addresses connected to the Bitget attacker have been made public and are under active surveillance by blockchain security analysts. Consequently, Gracy Chen, CEO of Bitget, issued a direct appeal to THORChain requesting the protocol prevent these addresses from accessing the network.
“Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses,” she posted on social media platforms.
Chen further emphasized that the principle of decentralization should not serve as justification for facilitating the movement of illicitly obtained digital assets.
THORChain issued a response indicating it does not implement selective address blocking. The protocol drew parallels to Bitcoin and Ethereum networks, noting that these foundational blockchain systems similarly do not censor transactions involving stolen assets.
Representatives explained that emergency network halts are designed to safeguard the protocol’s infrastructure as a whole, rather than to selectively freeze individual transaction sets.
THORChain’s Previous Network Suspensions
THORChain has implemented network pauses previously, albeit under different circumstances. This past May, the protocol suspended all trading operations after approximately $10.7 million was extracted from one of its treasury vaults.
Network operators initiated a complete shutdown while development teams addressed the vulnerability. Normal trading operations remained suspended until June 22, representing approximately five weeks of downtime.
THORChain officials clarified that even during that incident, the attacker’s wallet addresses were never blacklisted. The organization maintains that temporarily halting operations to secure its native infrastructure fundamentally differs from blocking funds originating from external platform breaches.
Star Xu, founder of competing exchange OKX, challenged THORChain’s Bitcoin comparison. He contended that a network capable of pausing for internal losses while refusing to act on external theft cannot legitimately claim equivalence to Bitcoin’s censorship resistance.
THORChain’s infrastructure was also utilized in 2025 when threat actors attributed to North Korean state-sponsored groups laundered over $1 billion in compromised assets from the Bybit exchange.
Bitget has announced that a $464 million protection reserve will fully compensate all impacted users. Withdrawal services resumed Monday, commencing with bitcoin at 8:00 UTC. The exchange is providing bounties to individuals or organizations that successfully assist in freezing the stolen assets. As of Monday evening, THORChain has not implemented any blocks on the hacker’s wallet addresses, while the protocol’s native RUNE token has experienced a price increase exceeding 20 percent over the preceding 24-hour period.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
