A wallet linked to the attackers behind Bitget's $387.5 million security breach has converted approximately $6.3 million in ether into 75.2 bitcoin, using the THORChain protocol's native cross-chain infrastructure to move the stolen funds directly between the Ethereum and Bitcoin networks without routing through any centralized intermediary.

On-chain analysts tracking the outflows have identified 27 successful swaps involving roughly 2,390 ETH, with the resulting bitcoin sent to a single address. Because the conversions were executed entirely through THORChain, the transactions never touched a centralized exchange, where deposits or withdrawals could potentially have been blocked. Both Ethereum and Bitcoin record every transaction on public ledgers, so the conversions remain visible on-chain, though following the funds now requires correlating activity across two separate networks rather than one.

THORChain is particularly suited to this kind of cross-chain movement because it is built to support native-asset swaps without wrapped tokens or conventional bridges. Ethereum and Bitcoin run as independent ledgers with no native way to exchange assets directly, which is why a dedicated cross-chain protocol is required for this kind of conversion. THORChain's liquidity pools allow assets such as ETH and BTC to be exchanged with RUNE, the protocol's native token, acting as the settlement layer, while users interact directly from self-custody wallets, with no accounts or know-your-customer (KYC) requirements at the protocol level.

That same design also explains the controversy surrounding the transfers. Bitget asked THORChain to block the addresses linked to the attacker, but the protocol said its permissionless architecture does not provide a mechanism for selective address freezes. According to the network, its emergency controls are capable of halting broader network activity, but they are not designed to stop an individual swap. The contrast with centralized venues is structural: exchanges that custody customer deposits can act on specific addresses, while a protocol whose users transact from self-custody wallets offers no equivalent point of control.

The episode illustrates the trade-off at the core of THORChain: native, permissionless and direct cross-chain settlement makes the network useful for legitimate users moving liquidity between blockchains, while those same characteristics can make it difficult for exchanges to intervene when stolen funds flow through the system. With the converted 75.2 bitcoin now concentrated at a single address on the public Bitcoin ledger, the funds carry a fixed, publicly observable marker that on-chain analysts can continue to monitor.