THORChain has declined a request from Bitget to block a hacker's activities as approximately $6.3 million worth of ether was converted to bitcoin through its platform.
CoinDesk reported that 27 successful swaps converted about 2,390 ETH into 75.2 BTC, despite Bitget's appeal to halt transactions associated with the $387.5 million hack.
On Monday, a wallet associated with the Bitget hacker executed a swap of around 2,390 ether, valued at $6.3 million, for 75.2 bitcoin via THORChain. This occurred while Bitget urged the cryptocurrency swapping network to restrict transactions connected to stolen funds.
According to an analysis by CoinDesk of THORChain’s public transaction logs, 27 successful swaps were identified, moving approximately 2,390 ETH for 75.2 BTC, with all bitcoin being directed to a single address. Additionally, four other swaps involving 400 ETH were still pending.
The transaction details indicate that orders were placed between 03:55 and 06:23 UTC on Monday from an Ethereum wallet identified by blockchain analytics firm Lookonchain as part of the hacker's activities. Most transactions were executed in batches of about 100 ETH, each worth approximately $265,000.
THORChain facilitates asset exchanges across various blockchains without requiring users to set up accounts on centralized exchanges. This enables an attacker to send stolen ether and receive bitcoin in a different wallet without going through an exchange that could block such transfers. Although these swaps remain publicly accessible, they allow investigators to trace the movement of funds across different networks.
Bitget suffered a loss of around $388 million due to a breach on September 24, where an assailant circumvented the security measures protecting its wallets. The exchange has since indicated that it has identified and resolved the security flaw, but has not disclosed how the breach occurred.
Following the attack, Bitget released the addresses of the hacker and promised a 5% bounty for any efforts to freeze or recover the stolen assets. As the hacker began transferring assets through various platforms, Bitget CEO Gracy Chen publicly requested THORChain to refuse transactions from the identified addresses over the weekend.
“Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses,” she posted on X. “Decentralization is a design principle, not a shield for facilitating known stolen funds.”
In response, THORChain defended its policy of allowing unrestricted access to its network and clarified that its emergency shutdown protocols differ from a selective address blacklisting.
“A THORChain network halt is an emergency security mechanism designed to protect the protocol,” the project stated. “A halt is not a selective freeze of specific funds or an individual swap.”
THORChain's operators possess capabilities to interrupt trading activities, as outlined in their documentation, which describes settings that can suspend swaps across all connected blockchains or limit activity involving specific chains, like Ethereum. However, implementing these controls would also disrupt transactions for other users on the affected networks.
Previously, THORChain employed emergency measures in May when an attacker stole approximately $10.7 million from its vaults. Operators coordinated a shutdown while developers investigated and rectified the vulnerability, allowing trading to resume on June 22 after about five weeks.
THORChain emphasized that the addresses of the May attacker were never blacklisted, as that intervention was necessary to protect its own protocol, whereas Bitget is requesting THORChain to reject funds stolen from an external exchange.
Read More: Thorchain halts trading after $10 million cross-chain exploit, RUNE token drops 12%
Additionally, records from Monday's swaps indicate the hacker faced trading restrictions, as two 100 ETH orders were only partially fulfilled due to not meeting the minimum price requirements, resulting in about 114 ETH being returned to the sending wallet.