On-chain data indicates that the attackers behind the AFX Trade exploit converted 12,467 ETH into Bitcoin, shifting the stolen funds across assets as investigators track the AFX Trade hackers
On-chain data indicates that the attackers behind the AFX Trade exploit converted 12,467 ETH into Bitcoin, shifting the stolen funds across assets as investigators track the AFX Trade hackers' wallet trail.
The conversion was flagged by blockchain tracking account Lookonchain, which monitors attacker-linked wallets and cross-asset movement, in an on-chain report. The figure ties the movement directly to the AFX Trade case rather than to generic market flows. For related coverage, see MARA Holdings CEO Says AI Data Center Revenue per Unit of Power Beats Bitcoin Mining.
AFX Trade, an Arbitrum-based platform, was drained of roughly $24 million after its bridge keys were compromised, according to reporting on the breach. That compromise is the origin point for the funds now being routed into Bitcoin. For related coverage, see Stablecoin Inflows to Exchanges Hit 2025 Lows, Signaling Weak Crypto Demand.
The primary evidence for the story is the transfer activity from attacker-linked wallets, not statements from the platform. Wallet behavior consistent with a single operator underpins the tracing. For related coverage, see Trader Says Long-Term Bitcoin Holder Losses Exceed FTX Era.
The attacker address remains viewable on-chain, and its transaction history can be examined directly on the block explorer. That record is what allows the ETH-to-BTC conversion to be attributed to the same entity. For related coverage, see Bitcoin Whale Sets 10 Targets, Eyes Longs if BTC Holds $64K.
The conversion follows an earlier tranche in the same case, in which an AFX Trade hacker swapped 655.4 ETH for 18.86 BTC via THORChain. That pattern points to cross-chain swap routing rather than a single centralized exchange.
Moving Ether into Bitcoin through a decentralized cross-chain route lets an operator change asset exposure without passing through a custodial checkpoint. In hack reporting, a shift into BTC matters because it typically signals an attempt to consolidate and hold value outside the compromised chain.
Cross-asset conversion complicates recovery because funds no longer sit on the network where the breach occurred. Investigators following the trail must now watch Bitcoin destinations rather than only Ethereum or Arbitrum addresses.
After a move like this, analysts generally track whether the converted BTC is consolidated, split across fresh wallets, or sent toward mixing services. Each pattern changes how realistic recovery becomes for affected AFX Trade users.
The most material follow-up signal would be further movement of the converted Bitcoin, especially into new destination wallets or deposit addresses. Splitting behavior would suggest an operator preparing to obscure the trail.
Dormancy, by contrast, would indicate the funds are being held. Confirmation from AFX Trade or independent blockchain analysts would help validate any next-stage developments beyond the current wallet evidence.
What happened in the AFX Trade case? The Arbitrum-based AFX Trade platform was drained of about $24 million after its bridge keys were compromised, and attacker-linked wallets have since moved funds across assets.
How much ETH was converted? On-chain tracking indicates the attackers converted 12,467 ETH into Bitcoin.
Does converting ETH to BTC make recovery harder? It can. Moving value onto a different chain forces investigators to follow Bitcoin destinations, and cross-asset routing removes the funds from the network where the breach originated.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post AFX Trade Hackers Converted 12,467 ETH to BTC: On-Chain Data was initially published on Coincu.
