Hacker Swaps $6.3M Stolen Funds as Network Denies Freeze

An attacker responsible for a massive September 24 exchange breach is actively laundering stolen assets through a decentralized network. Despite pleas from the victimized exchange's CEO to intervene, the decentralized protocol has refused to implement a targeted freeze on the transactions.

The hacker's wallet has successfully converted approximately $6.3 million worth of Ethereum (ETH) into Bitcoin (BTC). The conversion was executed across 27 distinct swaps on Monday, occurring between 03:55 and 06:23 UTC. In these transactions, roughly 2,390 ETH were traded for 75.2 BTC, all of which was directed to a single receiving address. Most of the individual orders were sized around 100 ETH, equating to approximately $265,000 per batch at current prices.

At the time of the initial review, an additional 400 ETH remained pending across four transactions. Some trading limits impacted the hacker's attempts; minimum price requirements prevented the full execution of certain 100 ETH orders, resulting in about 114 ETH being routed back to the initiating wallet. Blockchain tracking platform Lookonchain originally spotted the wallet as part of the attacker’s broader operations.

The laundering stems from a severe security breach on September 24, which saw nearly $352 million stolen from the centralized cryptocurrency exchange Bitget. The targeted platform stated that the underlying vulnerability has been discovered and patched, though the technical specifics of the security breach remain undisclosed. To incentivize the return of the assets, Bitget has publicly shared the attacker’s wallet addresses and declared a 5% bounty for any good faith attempts to freeze or recover the stolen funds.

Dispute Over Freezing Funds

Over the weekend, Bitget CEO Gracy Chen made a public appeal to the decentralized exchange facilitating the cross-chain swaps. The platform, THORChain, allows users to transfer assets between different blockchains without relying on a centralized intermediary. Because the swaps occur on-chain, blockchain researchers and security teams can still trace the funds, but halting the transactions becomes significantly more difficult once they are introduced into the decentralized system.

Taking to X, Chen urged the network to block the hacker's ongoing operations. “Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses,” she wrote. Chen further argued, “Decentralization is a design principle, not a shield for facilitating known stolen funds.”

THORChain rejected the request for a targeted freeze. Representatives stated that the network’s emergency controls are built to protect the protocol itself rather than block specific wallets.

“A THORChain network halt is an emergency security mechanism designed to protect the protocol,” the development team explained, noting further that “A halt is not a selective freeze of specific funds or an individual swap.”

According to the network, its internal controls can suspend swaps entirely or limit activity on a specific blockchain, but activating these measures would also impact legitimate users. THORChain had previously utilized its halt function following an exploit of its own vaults that took approximately $10.7 million. Trading on the network only restarted on June 22 after developers fixed the vulnerability.