coindesk.comarticleTHORChain rejects Bitget request to block hacker as $6 million moves to bitcoin
CoinDesk traced 27 successful THORChain swaps converting roughly 2,390 ETH into 75.2 BTC for a wallet linked to the attacker behind Bitget's $388M Sept. 24 breach, all payouts routed to a single bitcoin address. Bitget publicly asked THORChain to block the attacker's identified addresses and offered a 5% bounty for freezing or recovering funds, but THORChain refused selective blacklisting, saying its emergency controls can only halt an entire chain's activity, not target individual addresses — a stance it also held after its own $10.7M May exploit.
TL;DR THORChain refuses to block a Bitget hacker's addresses as $6.3M in stolen ETH is swapped cross-chain into bitcoin, exposing the limits of decentralized-protocol fund freezing.
Organisations named here
- Gracy Chen
Technologies named here
- Bitget exchange wallets
- THORChain
- Lookonchain
- THORChain vaults
- Ethereum
- Bitcoin
- Bitget
Techniques named here
- Cross-chain swapping via decentralized protocol
- Bypassing exchange security controls
Threat actors named here
- Bitget hacker
- THORChain May 2026 attacker
Related in Blockchain
blog.thorchain.orgwriteupTHORChain Exploit Report #2 — GG20 root-cause disclosure
protos.comarticleBlack Thursday revisited: MakerDAO keeper exploited for $500K
.jpg)
aikido.devwriteupGraphalgo campaign spreads to Terraform providers and Go Modules
sundaytimes.lkarticle