Key Points
- An address connected to the Bitget attacker exchanged approximately 2,390 ETH (valued at $6.3 million) for 75.2 BTC via THORChain on Monday.
- The Bitget platform suffered a devastating $387.5 million security breach on September 24 when an unauthorized party circumvented protective measures.
- Gracy Chen, CEO of Bitget, made a direct public appeal to THORChain requesting the blacklisting of addresses associated with the attacker.
- THORChain declined the request, maintaining its policy of treating every user equally, similar to how Bitcoin and Ethereum networks operate without selective restrictions.
- In May 2026, THORChain temporarily halted operations following a $10.7 million loss from its treasury, though officials maintain this situation differs from freezing externally stolen assets.
The cryptocurrency platform Bitget experienced a catastrophic security breach on September 24, resulting in losses totaling approximately $387.5 million. Following the incident, the pilfered digital assets have been traversing various blockchain networks, with recent activity drawing significant scrutiny.
During Monday’s trading activity, an address associated with the perpetrator executed a transaction converting approximately 2,390 ether tokens, valued near $6.3 million, into 75.2 bitcoin. This conversion was facilitated through the THORChain protocol.
THORChain operates as a decentralized cross-chain liquidity platform, enabling users to exchange various cryptocurrencies without intermediary institutions such as traditional financial entities or centralized exchanges. The protocol requires no identity verification or registered accounts.
CoinDesk examined publicly available blockchain data from THORChain’s network. The investigation revealed 27 completed transactions that successfully converted approximately 2,390 ETH into 75.2 BTC, with all resulting bitcoin directed to one destination address.
An additional four transactions involving 400 ETH remained in pending status. The majority of conversions were executed in increments of approximately 100 ETH, each transaction representing roughly $265,000 in value.
Bitget Leadership Appeals for Intervention
The addresses connected to the Bitget incident have been publicly identified and are under continuous monitoring by blockchain security analysts. In response, Gracy Chen, Bitget’s chief executive, issued a direct appeal to THORChain requesting action against the perpetrator’s access.
“Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses,” she stated via social media platforms.
Chen emphasized that the principle of decentralization should not serve as justification for facilitating the movement of illicitly obtained assets.
THORChain’s official response maintained that the protocol does not implement address-specific restrictions. Network representatives drew parallels to Bitcoin and Ethereum, noting that these foundational blockchain systems similarly do not enforce blocks on addresses associated with stolen funds.
The organization clarified that emergency network suspensions are implemented exclusively to safeguard the entire protocol infrastructure, not to selectively freeze individual transaction sets.
Network Has Implemented Previous Suspensions
THORChain has implemented network-wide halts previously, albeit under distinctly different circumstances. This past May, the protocol suspended all trading operations after approximately $10.7 million was extracted from one of its native treasury accounts.
Network validators initiated a complete shutdown while development teams addressed the vulnerability. Normal trading operations did not resume until June 22, following a five-week remediation period.
THORChain representatives emphasized that addresses involved in that particular incident were never blacklisted. The team maintains a clear distinction between pausing operations to secure internal infrastructure versus implementing restrictions on assets stolen from external platforms.
Star Xu, founder of competing exchange OKX, challenged THORChain’s comparison to Bitcoin’s operational model. He argued that a network capable of suspending operations for internal losses while refusing to act on external theft cases cannot legitimately claim equivalence to Bitcoin’s design principles.
THORChain’s infrastructure was also utilized in 2025 when threat actors believed to be connected to North Korean state-sponsored groups laundered over $1 billion in stolen cryptocurrency from the Bybit exchange.
Bitget has announced that a $464 million protection reserve will compensate all impacted users. Withdrawal services resumed Monday, starting with bitcoin processing at 8:00 UTC. The exchange is offering financial incentives to anyone providing actionable intelligence leading to asset recovery. As of Monday afternoon, THORChain has maintained its position against blocking the suspect addresses, while its native RUNE token has appreciated over 20 percent within the past 24 hours.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
