Bitget’s $350 million hacker makes first transaction move

The wallet linked to the Bitget hack has begun moving stolen funds for the first time since the crypto exchange lost more than $350 million in a September 24 security breach.

On Monday, on-chain trackers identified a key address associated with the attacker transferring Ethereum (ETH) into THORChain vaults and rapidly converting the assets into Bitcoin (BTC).

The transactions mark the first major movement of funds since the incident and represent a significant development in efforts to track and recover the stolen assets.

Bitget hacker transactions. Source: Lookonchain

The latest activity comes four days after Bitget detected unauthorized transfers from several hot and warm wallets.

The exchange initially estimated losses at approximately $351.6 million, though subsequent tracing raised the confirmed total to about $387.5 million after additional assets were linked to the attack.

Hacker converts stolen ETH into Bitcoin

Blockchain data shows the attacker sending ETH to THORChain in multiple transactions, often in batches of 100 ETH, before swapping the funds for BTC through the decentralized cross-chain protocol.

Earlier movements involving stolen XRP, BNB, and TRX were also routed through THORChain and similar bridging services before being converted into Bitcoin. The activity contributed to a temporary surge in THORChain trading volume and network fees.

A substantial portion of the stolen assets has already been converted into Bitcoin, while the remaining Ethereum holdings continue to move through the same route.

Some of the resulting BTC has reportedly been processed using transaction-obfuscation techniques, making the funds more difficult to trace.

Investigation into the Bitget hack continues

Bitget stated that the attackers did not gain access to private keys. Instead, the breach allegedly involved the compromise of a critical backend component that allowed fraudulent transaction data to pass through the exchange’s authorization process.

The attack enabled coordinated transfers across multiple blockchains and affected assets including Ethereum, XRP, stablecoins, BNB, AVAX, and Tron-based tokens. Bitget’s cold wallets and separate self-custodial wallet service were not impacted.

Bitget has published attacker-linked wallet addresses and called on industry participants to help freeze and recover stolen funds. The exchange also asked THORChain to block the identified wallets, but the protocol said its permissionless network cannot selectively restrict addresses.

Withdrawals resumed on September 28, starting with Bitcoin and expanding to other assets in phases.

 Bitget said customer funds remain protected through its User Protection Fund and that a full technical postmortem will be released after the investigation concludes.

Featured image via Shutterstock

eToro is a multi-asset investment platform. The value of your investments may go up or down. Your capital is at risk. Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong. Take 2 mins to learn more.