A wallet linked to the attackers behind Bitget’s $387.5 million breach converted about $6.3 million in ether into 75.2 bitcoin through THORChain using the network’s native cross-chain infrastructure to move funds directly between Ethereum and Bitcoin.

MILESTONE | BitGet Says Stolen Funds Nearing $400 Million as Security Breach Unfolds

Analysts have identified 27 successful swaps involving about 2,390 ETH with the resulting bitcoin sent to a single address. The transactions were carried out without using a centralized exchange where deposits or withdrawals could potentially be blocked.

THORChain is particularly suited to this type of cross-chain movement because it supports native-asset swaps without wrapped tokens or conventional bridges.

Its liquidity pools allow assets such as ETH and BTC to be exchanged through RUNE as the settlement layer while users interact directly from self-custody wallets without accounts or KYC at the protocol level.

CASE STUDY | Hackers of a Leading European Fintech Demand Ransom via Untreacable Crypto Token

That design also explains the controversy surrounding the transfers.

Bitget asked THORChain to block addresses linked to the attacker, but the protocol said its permissionless architecture does not provide selective address freezes. Its emergency controls can halt broader network activity but are not designed to stop an individual swap.

The episode illustrates the trade-off at the core of THORChain – native, permissionless and direct cross-chain settlement makes it useful for legitimate users moving liquidity between networks — while the same characteristics can make it difficult for exchanges to intervene when those funds are stolen.

CRYPTO CRIME | Why BitGet Hacker Was Able to Move Over $80 Million in Stolen XRP

Sign up to BitKE to get the latest developments on crypto globally.

Join our WhatsApp channel here.

Follow us on X for the latest posts and updates

Join and interact with our Telegram community

_________