Reports indicate that hackers linked to the Bitget exchange stole $351.6 million and subsequently routed the stolen funds through THORChain, converting Ethereum (ETH) into Bitcoin (BTC) in wh
Reports indicate that hackers linked to the Bitget exchange stole $351.6 million and subsequently routed the stolen funds through THORChain, converting Ethereum (ETH) into Bitcoin (BTC) in what appears to be a deliberate cross-chain asset movement following the theft.
KEY FACTS
According to circulating reports, attackers drained funds totaling $351.6 million from Bitget-associated wallets, placing this incident among the larger single-event exchange thefts reported in 2026. Blockaid data recorded over $1 billion stolen from crypto protocols in H1 2026 alone, underscoring the sustained pace of exchange-level exploitation this year. For related coverage, see Crypto Derivatives Update: Funding, Open Interest & Liquidations | Sept 27, 2026.
Following the initial theft, the reported laundering route involved converting ETH holdings into BTC via THORChain. All incident-specific claims derive from unconfirmed reports; no on-chain transaction hash or block explorer record has been independently verified by this publication at time of writing.
THORChain is a decentralized cross-chain liquidity protocol that allows users to swap native assets between separate blockchains without wrapping tokens or relying on a centralized intermediary. A swap executed through THORChain does not erase public blockchain transaction records; both the outgoing ETH transaction and the incoming BTC transaction remain visible on their respective explorers.
The distinction between ETH and BTC matters for post-theft tracking. Ethereum's programmable transaction model allows ETH flows to be tagged at the contract level; Bitcoin's UTXO-based structure complicates automated clustering. Converting ETH to BTC via a cross-chain protocol shifts the analytical burden from Ethereum tooling to Bitcoin chain analysis, requiring investigators to correlate activity across two separate ledgers rather than one.
Cross-chain swaps introduce a seam in the forensic trail. Each blockchain maintains its own independent record, and on-chain analytics firms must reconcile those records to re-link the pre-swap ETH addresses to the post-swap BTC addresses, adding complexity relative to same-chain transfers.
The reported $351.6 million movement follows a recurring post-theft pattern: stolen assets routed through decentralized cross-chain venues to fragment the forensic trail. State-linked actors have similarly moved multi-million dollar BTC holdings after converting from other assets, exploiting Bitcoin's pseudonymous ledger structure.
Public blockchain ledgers remain fully auditable; blockchain analytics firms can trace cross-chain swap events when protocol-level data is combined with address-clustering heuristics. THORChain's own on-chain records are publicly accessible, meaning the swap legs are not hidden, only fragmented across chains. Investigators working this incident would reference both Etherscan-side origination data and Bitcoin block explorer records on the destination side.
For exchange operators, the incident reinforces hot-wallet exposure as the primary attack surface. Cold storage segregation, multi-signature withdrawal authorization, and real-time anomaly detection on large outflows are the standard mitigations. Prior high-profile movements on platforms like Hyperliquid illustrated how quickly large sums can exit a protocol before detection triggers fire.
Custodial concentration remains the critical user-side risk metric: funds held on a single centralized exchange carry counterparty exposure to that platform's security posture. The H1 2026 loss tally makes diversifying custody across cold wallets and multiple venues a non-discretionary risk management step.
No confirmed recovery figures, attacker identities, or law enforcement actions have been reported in connection with this theft at time of publication. Blockchain analytics firms tracking large cross-chain flows represent the next likely source of on-chain attribution data as the investigation develops.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on marketbit.net