According to reports, the suspected hacker used THORChain, the decentralised cross-chain liquidity protocol, to swap Ethereum for Bitcoin. A freeze request, submitted in an attempt to halt the movement of funds, was rejected by the protocol. For related coverage, see Bitget Restricts HTX, EXMO, 14 Others Amid Sanctions Crackdown.
THORChain operates as a permissionless system, meaning no central authority controls whether specific transactions proceed. The rejection of the freeze request underscores the structural challenge of pursuing stolen funds across decentralised infrastructure: without a governing body that can intervene, blocking a specific swap is not straightforward. No reason for the rejection has been officially confirmed at the time of writing. For related coverage, see Blockstream Refuses Ransom Over $47M Liquid Bitcoin Hack.
Why the ETH-to-BTC Swap Complicates Recovery Efforts
Moving funds from Ethereum to Bitcoin changes the tracking environment significantly. Ethereum’s transparent smart-contract architecture and robust block explorer tooling have long made it a more traceable chain for investigators. Bitcoin, while fully transparent on-chain, carries a more fragmented tracing landscape, particularly when funds subsequently move through mixing or coinjoin services. For related coverage, see Blockstream Rejects Ransom After 85% BTC Recovery: Liquid Exploit.
Reports from blockchain analytics firm AMLBot show the difficulty of keeping pace with stolen Bitget funds once they enter the Bitcoin network. AMLBot traced 4 BTC from the Bitget hack to Wasabi, a coinjoin mixing tool, illustrating how quickly on-chain trails can fragment after a cross-chain conversion.
The timing of the swap, coming alongside a failed freeze attempt, suggests the actor moved quickly once the window for an asset hold closed. Whether that speed reflects awareness of the freeze attempt or simply standard post-hack laundering behaviour is not established by available reporting.
What Happens Next
Bitget itself has taken operational steps in the aftermath of the hack. Bitget resumed Bitcoin withdrawals after the hacker’s THORChain swap, signalling that the exchange moved to restore services even as the investigation continued.
The three developments that would materially change the outlook for fund recovery are: verified on-chain transaction data linking specific wallet addresses, an official response from Bitget or law enforcement on tracing progress, and any action taken at exchange level if the Bitcoin eventually surfaces on a custodial platform.
For now, the funds’ status remains unresolved. The rejected freeze request and the cross-chain conversion raise the same question every major crypto hack eventually forces: when decentralised infrastructure is the getaway vehicle, who has the authority to stop it?
Additional source references: source document 1, source document 2.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
