Bitget Hacker's 27 Swaps Ended at One Address, Then Bitcoin
The exchange asked the network to freeze the stolen addresses. The network declined, and the Ethereum came out the other side as Bitcoin.
Bitget asked THORChain to freeze the addresses from its September 24 breach; the network refused[1]. A wallet tied to the hacker ran 27 swaps, about 2,390 ETH into 75.2 BTC, all to one receiving address, about $6.3 million, from 03:55 to 06:23 UTC Monday[2][1].
Blockchain investigator ZachXBT says illicit actors “are openly asking for assistance with laundering funds” in public Discord and Telegram channels, crossing bridges into mixers including Wasabi[3][4]. One account, Alias 4, was linked to the $292 million KelpDAO exploit[5].
AMLBot reported roughly $343 million, about 88% of the tracked total, untouched across thirteen attacker-controlled addresses[6].
What to do: Bitget users can withdraw — BTC at 08:00 UTC on September 28, then ETH September 29 and USDT September 30[7].
Who gains, who loses
Receipts
A wallet tied to the Bitget hacker converted about $6.3 million in Ethereum into Bitcoin through THORChain after the exchange asked the network to freeze addresses linked to its Sept. 24 breach, and THORChain refused.
“A wallet tied to the Bitget hacker converted about $6.3 million in Ethereum into Bitcoin through THORChain after the exchange asked the network to freeze addresses linked to its Sept. 24 breach.”
The wallet completed 27 swaps, converting about 2,390 ETH into 75.2 BTC, all routed to a single receiving address, with most orders submitted between roughly 03:55 and 06:23 UTC on Monday.
“The wallet completed 27 swaps, converting about 2,390 ETH into 75.2 BTC, all routed to a single receiving address.”
Chinese illicit actors are openly asking for assistance with laundering funds stolen in the $387 million Bitget exploit through public Discord and Telegram channels, according to blockchain investigator ZachXBT.
ZachXBT said the Bitget exploit funds are currently being moved between blockchains using bridges and sent to mixing services including Wasabi.
“He said the Bitget exploit funds are currently being moved between blockchains using bridges and sent to mixing services including Wasabi.”
ZachXBT identified five accounts laundering the Bitget exploit funds and noted that one, Alias 4, had previously been linked to the laundering of funds from the $292 million KelpDAO exploit.
“He identified five accounts and noted that one, Alias 4, had previously been linked to the laundering of funds from the $292 million KelpDAO exploit.”
AMLBot reported that roughly $343 million — about 88% of the tracked total — remains untouched across thirteen dormant attacker-controlled addresses, including eight Ethereum wallets holding around 68,300 ETH and four XRP addresses holding approximately 83 million XRP.
“AMLBot reported that roughly $343 million—about 88% of the tracked total—remains untouched across thirteen dormant attacker-controlled addresses, including eight Ethereum wallets holding around 68,300 ETH and four XRP addresses holding…”
Bitget opened Bitcoin-network BTC withdrawals at 08:00 UTC on Sept. 28, the first stage of a phased plan that adds ETH on Sept. 29 and USDT on Sept. 30.
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.