A wallet linked to the Bitget hacker moved roughly $6.3 million worth of ether into bitcoin using THORChain, the cross-chain liquidity protocol. The swap went through even after Bitget CEO Gracy Chen asked THORChain to freeze or cut off the hacker's addresses. THORChain declined.
The $6.3 million swap
THORChain handles native asset swaps without wrapping tokens or relying on a central custodian. That design let the hacker convert ETH to BTC directly, and the funds were moved to a bitcoin address. The exact on-chain path hasn't been detailed publicly, but the swap itself is the latest step in a trail that Bitget is trying to follow.
Gracy Chen's request and THORChain's refusal
Chen's ask was direct: freeze the addresses or cut them off so the funds couldn't move. THORChain said no. The protocol's architecture and its stated commitment to permissionless, non-custodial operations leave no admin key to flip. Nodes validate swaps, but they don't have a switch to blacklist a wallet. That's the trade-off behind the refusal — and it's now a live case study in what happens when a centralized exchange's incident response meets a decentralized protocol's rules.
Exchange hacks and the cross-chain problem
When stolen funds stay on one chain, exchanges and issuers can sometimes coordinate a freeze. Cross-chain swaps break that playbook. Once ETH becomes BTC through a protocol like THORChain, the asset is on a different network with different tracking tools and different venues. Recovery usually depends on the hacker making a mistake — moving to a KYC exchange, for instance — or on law enforcement eventually tracing the path. Neither is guaranteed, and the $6.3 million is now on the bitcoin side of that gap.
What's still unresolved
Bitget hasn't said whether it's working with blockchain analytics firms or law enforcement on this specific transfer. THORChain hasn't outlined any exception to its no-freeze stance. The bitcoin address holding the funds hasn't been publicly tied to a known service. For now, the swap stands, and the question of how a centralized exchange recovers assets from a decentralized protocol remains open.
