On-chain monitoring data shows that a wallet linked to the AFX Trade exploit converted 655.4 ETH into 18.86 BTC through THORChain, executing a single cross-chain transaction that moved stolen funds from Ethereum to Bitcoin.

The movement was flagged by security monitoring accounts including Blockaid. THORChain, the swap route identified in the tracking, is a protocol designed for native cross-chain asset exchanges.

Background: The AFX Trade Exploit

The swap follows an attack on AFX Trade, an Arbitrum-based protocol that was drained of approximately $24 million after its bridge keys were compromised. Bridge-key compromises are closely watched in DeFi because bridge infrastructure can control movement of assets between networks, making key security central to preventing large-scale losses. AFX Trade acknowledged the incident through its official X account. The exploit has been documented in independent reporting by CoinDesk and The Block.

The on-chain conversion represents a portion of the stolen funds being repositioned. It does not constitute final proof of a completed laundering process.

Why THORChain Matters in This Swap

THORChain enables direct swaps between native assets across separate blockchains, allowing an operator to exchange ETH for BTC without using a wrapped token or routing through a centralized exchange. This capability changes both the blockchain on which the wallet resides and the monitoring framework that investigators must adopt.

A conversion into native Bitcoin draws particular attention from on-chain analysts because it disrupts single-network tracking. Following the funds now requires monitoring Bitcoin wallet clusters rather than Ethereum addresses, a shift that complicates straightforward end-to-end tracing.

Tracing and Recovery Implications

Cross-chain movement can introduce obstacles for investigators and security teams attempting to recover breached funds. The conversion into Bitcoin may alter the set of wallet clusters that analysts track going forward.

However, the swap represents a single data point rather than confirmation of a completed cash-out. Investigators typically monitor follow-on transactions after such conversions, including whether funds are split across multiple addresses, sent to exchanges, or moved through additional liquidity routes. Cross-chain movement alone does not render funds unrecoverable.

Broader Security Context

High-profile exploit fund flows are routinely tracked publicly by security researchers, which is how the AFX Trade movement initially surfaced. Wallet screening and rapid incident response remain critical for platforms following a breach, as compromised funds can move through cross-chain liquidity venues within hours.

The pattern is reminiscent of other recent DeFi incidents where fund movement was closely monitored, including the Across Protocol relayer attack that resulted in under $4 million in net losses. Transparent blockchains enable near real-time community tracking of exploit-related flows even when attribution remains uncertain.

The broader market environment adds urgency for exchanges monitoring suspicious wallets, with stablecoin inflows to exchanges sitting at 2025 lows and Ethereum spot ETFs recording renewed outflows.