The exploiter behind the Bitget crypto exchange hack has converted 2,390 Ethereum (ETH) worth $6.3 million into 75.2 Bitcoin (BTC) using the cross-chain protocol THORChain. The cross-chain asset movement occurred after the THORChain network rejected Bitget’s official request on September 24 to blacklist digital wallet addresses tied to the theft.
On-chain analytics tracker Lookonchain identified the Ethereum wallet initiating the swap orders as part of the attacker’s fund movements. Network records show 27 swap transactions were successfully completed by the protocol, with all resulting Bitcoin transferred to a single recipient address.
Split into 100 ETH Batches
The hacker carried out the swaps on Monday between 03:55 and 06:23 UTC. The attacker split most orders into 100 ETH increments, each batch valued at roughly $265,000 at execution time.
The protocol engine rejected two 100 ETH orders that were only partially filled after slipping past minimum price thresholds. As a result of the rejection, around 114 ETH bounced and was automatically refunded to the sender’s original Ethereum wallet. Aside from the completed transactions, four other laundering transactions carrying 400 ETH remained pending at the time the attacker’s activity records were reviewed.
Connecting to Last Month’s CoinJoin Route
The hacker’s move to launder 2,390 ETH extends an asset-concealment trail initially flagged on September 27. At that time, compliance and asset tracking firm AMLBot detected four stolen Bitcoin from Bitget moving across three separate platforms.
The attacker transferred the four stolen Bitcoin from the TRON network to Ethereum, bridged them once more via THORChain, and subsequently routed the stolen coins into Wasabi CoinJoin mixing rounds to break the transaction trail.
Censorship-resistant cross-chain infrastructure has once again proved to be a go-to path for hackers when centralized entities fail to secure protocol-level fund freezes. Reported by crypto.news.
Read also: What Is DeFi (Decentralized Finance)?
Previously: THORChain Lets 101.5 Stolen Bitget BTC Slip Through - GoPlus Exposes Validators’ Centralized Authority
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
