On-chain data indicates that the attackers behind the AFX Trade exploit converted 12,467 ETH into Bitcoin, moving stolen funds across assets as investigators continue to follow wallets linked to the breach.

The conversion was flagged by blockchain tracking account Lookonchain in an on-chain report. Lookonchain monitors attacker-linked wallets and cross-asset fund movements, and the reported figure connects the transaction activity to the AFX Trade case rather than to broader market flows.

AFX Trade, an Arbitrum-based platform, was drained of roughly $24 million after its bridge keys were compromised, according to reporting on the breach. Bridge-key compromises are closely watched in decentralized finance because bridge infrastructure controls transfers between networks; when those keys are exposed, attackers may be able to move or unlock assets without exploiting ordinary user wallets. That compromise is the starting point for the funds that are now being routed into Bitcoin.

On-Chain Evidence

The main evidence in the case comes from transfer activity involving wallets linked to the attacker, rather than from statements issued by AFX Trade. The tracing is based on wallet behavior that appears consistent with a single operator moving funds through a connected sequence of transactions.

The attacker address remains visible on-chain, and its transaction history can be reviewed directly through the block explorer. That public transaction record is what allows analysts to attribute the ETH-to-BTC conversion to the same entity connected to the exploit. Public ledgers can show fund flows in detail, but attribution still depends on linking addresses to a known incident through transaction patterns, timing, and prior reporting.

How the ETH Was Moved Into BTC

The latest conversion follows an earlier transaction in the same case, in which an AFX Trade hacker swapped 655.4 ETH for 18.86 BTC through THORChain. That activity points to the use of cross-chain swap routing rather than a single centralized exchange.

Moving Ether into Bitcoin through a decentralized cross-chain route allows an operator to change asset exposure without using a custodial platform as the main checkpoint. In hack investigations, movement into BTC is significant because it can indicate an effort to consolidate value outside the network where the exploit occurred.

Impact on Tracing and Recovery

Cross-asset conversion can make recovery more complicated because the funds no longer remain only on the network where the breach took place. Investigators following the AFX Trade trail must monitor Bitcoin destinations in addition to Ethereum or Arbitrum addresses.

After a conversion of this kind, blockchain analysts typically watch whether the converted BTC is consolidated in one destination, split among newly created wallets, or sent toward mixing services. Each pattern can affect the feasibility of tracing and recovering funds for affected AFX Trade users.

The most important follow-up signal would be additional movement of the converted Bitcoin, particularly transfers into new destination wallets or deposit addresses. Splitting the funds could suggest an attempt to obscure the trail, while dormancy would show that the assets are being held.

Further confirmation from AFX Trade or independent blockchain analysts would help validate any next-stage developments beyond the current wallet evidence. For now, on-chain tracking indicates that attacker-linked wallets connected to the Arbitrum-based AFX Trade exploit have moved funds across assets, including the conversion of 12,467 ETH into Bitcoin.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk.