Liquid

Request

THORChain

Ethereum

Bitcoin

The wallet linked to the Bitget hack has reportedly converted Ethereum holdings into Bitcoin, a move that followed THORChain’s rejection of a request to freeze the funds in transit. The development marks a significant turn in efforts to trace and recover stolen assets from one of the exchange’s most closely watched security incidents.
According to reports, the suspected hacker used THORChain, the decentralised cross-chain liquidity protocol, to swap Ethereum for Bitcoin. A freeze request, submitted in an attempt to halt the movement of funds, was rejected by the protocol. For related coverage, see <a href="https://www.theccpress.com/bitget-restricts-transactions-htx-exmo-sanctions-crackdown/" rel="noopener noreferrer nofollow">Bitget Restricts HTX, EXMO, 14 Others Amid Sanctions Crackdown</a>.
THORChain operates as a permissionless system, meaning no central authority controls whether specific transactions proceed. The rejection of the freeze request underscores the structural challenge of pursuing stolen funds across decentralised infrastructure: without a governing body that can intervene, blocking a specific swap is not straightforward. No reason for the rejection has been officially confirmed at the time of writing. For related coverage, see <a href="https://www.theccpress.com/blockstream-refuses-ransom-47m-bitcoin-liquid-hack/" rel="noopener noreferrer nofollow">Blockstream Refuses Ransom Over $47M Liquid Bitcoin Hack</a>.
<h2 id="why-the-eth-to-btc-swap-complicates-recovery-efforts">Why the ETH-to-BTC Swap Complicates Recovery Efforts</h2>
Moving funds from Ethereum to Bitcoin changes the tracking environment significantly. Ethereum’s transparent smart-contract architecture and robust block explorer tooling have long made it a more traceable chain for investigators. Bitcoin, while fully transparent on-chain, carries a more fragmented tracing landscape, particularly when funds subsequently move through mixing or coinjoin services. For related coverage, see <a href="https://www.theccpress.com/blockstream-liquid-network-exploit-btc-recovery-ransom/" rel="noopener noreferrer nofollow">Blockstream Rejects Ransom After 85% BTC Recovery: Liquid Exploit</a>.
Reports from blockchain analytics firm AMLBot show the difficulty of keeping pace with stolen Bitget funds once they enter the Bitcoin network. <a href="https://www.theccpress.com/amlbot-traces-4-btc-bitget-hack-wasabi-coinjoin/" rel="noopener noreferrer nofollow">AMLBot traced 4 BTC from the Bitget hack to Wasabi</a>, a coinjoin mixing tool, illustrating how quickly on-chain trails can fragment after a cross-chain conversion.
The timing of the swap, coming alongside a failed freeze attempt, suggests the actor moved quickly once the window for an asset hold closed. Whether that speed reflects awareness of the freeze attempt or simply standard post-hack laundering behaviour is not established by available reporting.
<h2 id="what-happens-next">What Happens Next</h2>
Bitget itself has taken operational steps in the aftermath of the hack. <a href="https://www.theccpress.com/bitget-resumes-bitcoin-withdrawals-hacker-swaps-eth-thorchain/" rel="noopener noreferrer nofollow">Bitget resumed Bitcoin withdrawals after the hacker’s THORChain swap</a>, signalling that the exchange moved to restore services even as the investigation continued.
The three developments that would materially change the outlook for fund recovery are: verified on-chain transaction data linking specific wallet addresses, an official response from Bitget or law enforcement on tracing progress, and any action taken at exchange level if the Bitcoin eventually surfaces on a custodial platform.
For now, the funds’ status remains unresolved. The rejected freeze request and the cross-chain conversion raise the same question every major crypto hack eventually forces: when decentralised infrastructure is the getaway vehicle, who has the authority to stop it?
Additional source references: <a href="https://www" rel="noopener noreferrer nofollow">source document 1</a>, <a href="https://m" rel="noopener noreferrer nofollow">source document 2</a>.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article <a href="https://www.theccpress.com/?p=48653" rel="noopener noreferrer nofollow">Bitget Hacker Swaps Ethereum for Bitcoin After THORChain Rejects Freeze Request</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.

Bitget Hacker Swaps Ethereum for Bitcoin After THORChain Rejects Freeze Request

Table of Contents

Cryptocurrency Press

Other articles published on Sep 28, 2026

Join our free newsletter for daily crypto updates!