THORChain has denied Bitget's request to block a hacker's transactions as $6.3 million in ether was converted to bitcoin on its platform.
THORChain has turned down a request from Bitget to block a hacker's transfers after approximately $6.3 million in ether was converted to bitcoin using its platform.
Despite Bitget's appeal to halt transactions linked to a significant $387.5 million hack, 27 successful swaps facilitated the conversion of about 2,390 ETH into 75.2 BTC.
A wallet associated with the hacker executed a swap of roughly 2,390 ether for 75.2 bitcoin on Monday, prompting Bitget to ask THORChain to restrict transactions involving the stolen assets.
Analysis of THORChain’s transaction logs revealed that the swaps took place between 03:55 and 06:23 UTC, with orders primarily executed in batches of around 100 ETH, each valued at about $265,000. While 27 swaps were completed, four additional transactions involving 400 ETH remain pending.
THORChain enables users to exchange assets across different blockchains without the need for centralized exchange accounts, allowing the hacker to convert stolen ether to bitcoin without facing transaction blocks from exchanges. Although these transactions are publicly traceable, they still present challenges for investigators tracking the stolen funds.
Bitget experienced a major security breach on September 24, resulting in a loss of approximately $388 million when the hacker bypassed wallet security. The exchange has since claimed to have identified and fixed the vulnerability but has not disclosed specific details about how the breach occurred.
Following the incident, Bitget publicly shared the hacker's addresses and offered a 5% bounty for assistance in freezing or recovering the stolen funds. As the hacker began to transfer assets through various channels, Bitget's CEO Gracy Chen urged THORChain to deny transactions from the flagged addresses over the weekend.
“Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses,” Chen stated on X. “Decentralization is a design principle, not a shield for facilitating known stolen funds.”
In response, THORChain defended its operational policy, emphasizing that it allows unrestricted access to its network and that its emergency shutdown protocols are not designed to selectively blacklist addresses. The project clarified that any network halt is a security measure aimed at protecting the protocol rather than a targeted freeze of specific funds.
THORChain's operators do have the ability to interrupt trading activities, as outlined in their documentation, which includes settings that can either suspend swaps across all blockchains or limit actions involving specific networks like Ethereum. However, implementing such measures would also inconvenience other users on the affected platforms.
Previously, THORChain had to employ emergency measures in May after an attack resulted in a theft of approximately $10.7 million, leading to a temporary shutdown while vulnerabilities were addressed. Trading resumed on June 22 after approximately five weeks of investigation and fixes.
THORChain noted that the addresses used in the May incident were never blacklisted, as the actions taken were necessary for the protection of its protocol, contrasting with Bitget's request to block transactions related to funds stolen from an external exchange.
Additionally, records from the recent transactions indicate that the hacker faced certain trading restrictions, as two orders of 100 ETH were only partially filled due to not meeting minimum price requirements, resulting in about 114 ETH being returned to the sending wallet.
