TLDR
An address connected to the Bitget breach converted approximately 2,390 ETH (valued at $6.3 million) into 75.2 BTC via THORChain on Monday.
The Bitget platform suffered losses totaling roughly $387.5 million during a security incident on September 24 following unauthorized access.
Bitget’s CEO Gracy Chen issued a public appeal to THORChain requesting intervention to freeze the attacker’s wallets.
THORChain declined the request, stating it maintains neutral operations similar to Bitcoin and Ethereum networks, without implementing selective address restrictions.
The protocol temporarily suspended operations in May 2026 following a $10.7 million loss from its own treasury, though officials distinguish this from blocking external stolen assets.
The cryptocurrency trading platform Bitget experienced a significant security breach on September 24, resulting in losses exceeding $387.5 million. Following the incident, the compromised assets have been migrating across multiple blockchain networks, with recent activity drawing considerable scrutiny.
THORChain Rejects Bitget’s Call to Block Attacker Funds After $387.5M Hack
THORChain responded to Bitget after CEO Gracy Chen called on the protocol to refuse service to addresses linked to attackers from Bitget’s September 24 security breach, which involved about $387.5 million… pic.twitter.com/hAhoCJKniv
— Wu Blockchain (@WuBlockchain) September 28, 2026
Recent blockchain analysis reveals that on Monday, a wallet address associated with the perpetrator executed a transaction converting approximately 2,390 ether tokens, valued near $6.3 million, into 75.2 bitcoin. This conversion occurred through THORChain’s decentralized infrastructure.
THORChain operates as a permissionless cross-chain liquidity protocol, enabling cryptocurrency exchanges without centralized intermediaries. The platform requires no identity verification or formal registration processes.
CoinDesk conducted an analysis of THORChain’s publicly available transaction data, identifying 27 completed swap operations. These transactions facilitated the conversion of approximately 2,390 ETH into 75.2 BTC, with all bitcoin proceeds directed to a singular receiving address.
An additional four conversion attempts involving 400 ETH remained in pending status. The majority of transactions were executed in increments of approximately 100 ETH, with each batch valued around $265,000.
Exchange Leadership Appeals for Network Intervention
The wallet addresses connected to the security breach have been identified and are under continuous monitoring by blockchain security analysts. In response, Bitget’s chief executive Gracy Chen issued a direct appeal to THORChain requesting the platform block access to these identified addresses.
“Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses,” she stated via social media channels.
Chen emphasized that decentralized principles should not serve as justification for facilitating the movement of misappropriated assets.
THORChain’s official response maintained the platform’s policy against implementing address-specific restrictions. Representatives drew parallels to foundational blockchain networks like Bitcoin and Ethereum, noting these systems similarly do not enforce selective fund freezes.
The organization clarified that emergency network suspensions exist to safeguard overall system integrity, not to selectively intervene in individual transaction flows.
Protocol’s Previous Network Suspension
THORChain has implemented network halts previously, albeit under distinct circumstances. During May, the protocol suspended all trading operations after approximately $10.7 million was extracted from one of its treasury vaults.
Network operators initiated a complete shutdown while development teams addressed the vulnerability. Normal operations resumed on June 22, following a five-week remediation period.
THORChain representatives noted that addresses involved in that incident were not subjected to permanent restrictions. The team maintains that protective measures for internal infrastructure differ fundamentally from blocking assets stolen from external platforms.
OKX founder Star Xu challenged THORChain’s comparison to Bitcoin’s neutrality. He argued that a protocol capable of pausing operations for internal losses while declining to act on external theft cannot legitimately claim Bitcoin-equivalent neutrality.
The platform previously facilitated the movement of over $1 billion in compromised assets during 2025, when threat actors with suspected North Korean connections laundered funds stolen from the Bybit exchange.
Bitget has announced that a $464 million reserve fund will reimburse all impacted users. The platform resumed withdrawal functionality on Monday, initiating with bitcoin at 8:00 UTC. Management has established a bounty program rewarding information leading to asset recovery. As of Monday evening, THORChain maintains its policy against address blacklisting, while the protocol’s RUNE token has appreciated over 20 percent within the preceding 24-hour period.
The post THORChain Declines Request to Freeze $387M Bitget Hacker Wallets Amid Bitcoin Conversion appeared first on Blockonomi.