TLDR
- A wallet linked to the Bitget hacker swapped about 2,390 ETH ($6.3 million) for 75.2 BTC through THORChain on Monday.
- Bitget lost about $387.5 million in a breach on September 24 after an attacker bypassed security controls.
- Bitget CEO Gracy Chen publicly asked THORChain to block the hacker’s addresses, calling for accountability.
- THORChain refused, saying it treats all users the same way Bitcoin and Ethereum do, without selective freezes.
- THORChain paused its network in May 2026 after losing $10.7 million from its own vault, but says that was different from blocking outside stolen funds.
A crypto exchange called Bitget lost about $387.5 million after a hacker broke into its systems on September 24. Since then, the stolen money has been moving across different blockchains, and one part of that process is now getting attention.
THORChain Rejects Bitget’s Call to Block Attacker Funds After $387.5M Hack
THORChain responded to Bitget after CEO Gracy Chen called on the protocol to refuse service to addresses linked to attackers from Bitget’s September 24 security breach, which involved about $387.5 million… pic.twitter.com/hAhoCJKniv
— Wu Blockchain (@WuBlockchain) September 28, 2026
On Monday, a wallet tied to the hacker swapped roughly 2,390 ether, worth about $6.3 million, for 75.2 bitcoin. The swap happened through a network called THORChain.
THORChain lets people trade one type of cryptocurrency for another without using a company like a bank or exchange. There is no ID check and no account needed.
CoinDesk looked at the public transaction records from THORChain. It found 27 swaps that were marked successful. These moved about 2,390 ETH into 75.2 BTC, and all of the bitcoin went to a single address.
Four more swaps involving 400 ETH were still listed as pending. Most of the trades were done in batches of around 100 ETH, each worth close to $265,000.
Bitget Asks THORChain To Step In
Bitget’s addresses tied to the hacker are public and being tracked by researchers. Because of this, Bitget CEO Gracy Chen asked THORChain directly to block the hacker from using the network.
“Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses,” she wrote on social media.
She added that decentralization should not be used as a shield for handling stolen funds.
THORChain responded and said it does not block specific addresses. The network compared itself to Bitcoin and Ethereum, saying those systems do not block stolen funds either.
The company said an emergency halt is meant to protect the entire network, not to freeze one group of transactions.
THORChain Has Paused Before
THORChain has stopped its network in the past, though for different reasons. In May, the network paused trading after roughly $10.7 million was drained from one of its own accounts, called a vault.
Operators shut down the system while developers fixed the issue. Trading did not restart until June 22, about five weeks later.
THORChain said the hacker’s addresses from that event were never blocked. The team argues that pausing to protect its own system is different from blocking funds stolen from an outside exchange.
Rival exchange OKX founder Star Xu pushed back on THORChain’s comparison to Bitcoin. He said a network that can pause for its own losses but not for others is not the same as Bitcoin.
THORChain was also used in 2025 when hackers linked to North Korea moved over $1 billion in stolen funds from another exchange called Bybit.
Bitget says a $464 million protection fund will cover all affected customers. Withdrawals restarted Monday, beginning with bitcoin at 8:00 UTC. The company is offering a reward for anyone who helps freeze the stolen funds. As of Monday, THORChain has not blocked the hacker’s wallets, and its RUNE token has risen more than 20 percent in the past day.
