Alleged attackers linked to the Bitget exchange reportedly converted approximately $351.6 million in stolen Ether into Bitcoin using THORChain, a decentralized cross-chain liquidity protocol,
Alleged attackers linked to the Bitget exchange reportedly converted approximately $351.6 million in stolen Ether into Bitcoin using THORChain, a decentralized cross-chain liquidity protocol, according to unconfirmed reports circulating as of late September 2026. No transaction hashes, wallet addresses, or block-level timestamps have been independently verified at the time of publication, and neither Bitget nor THORChain has issued a public statement confirming or denying the reported swap.
The unconfirmed claim centers on a single large asset conversion: stolen ETH valued at roughly $351.6 million exchanged for BTC. The figure is drawn from the circulating report and has not been corroborated by on-chain documentation, per a review of available evidence as of September 28, 2026. Because both ETH and BTC prices fluctuate, the USD-denominated value of any such transaction would have changed between the alleged execution time and the date of reporting. For related coverage, see Aurra Markets Crowned 'Best Emerging Broker' at Forex Expo Dubai 2026.
Bitget, one of the larger centralized derivatives platforms by volume, has expanded its product suite to include CFD trading for gold, forex, and stock indices in recent periods, making any breach of its asset infrastructure a material concern for users and counterparties. The reported stolen ETH amount, if accurate, would rank among the larger single-hack figures in the sector's recent history. Bitget has also added hundreds of stock rTokens to its platform, broadening its exposure to a wider user base whose funds could be affected by a security incident of this scale.
THORChain is named in the report as the venue through which the ETH-to-BTC conversion allegedly occurred. The protocol enables native cross-chain swaps without wrapped tokens or custodial intermediaries, which makes it structurally difficult to freeze or reverse a completed transaction. No specific pool, routing path, or confirmation block has been provided in the available reporting. For related coverage, see BIT Launches Hong Kong Stock Trading Service in Public Beta.
What is not established: the exact date or block height of the alleged swap, whether THORChain's liquidity providers were aware of the transaction's origin, or whether any on-chain monitoring service flagged the addresses involved. Readers seeking to search for associated wallet activity can consult the Etherscan address search for Bitget-related activity, though no specific addresses have been confirmed by any primary source in this report.
A $351.6 million cross-chain swap from ETH to BTC, if confirmed, would present a materially harder tracing challenge than a same-chain transfer. Once ETH exits the Ethereum network and BTC is received on the Bitcoin network, the two transaction records live on separate blockchains with no shared state, requiring investigators to reconstruct the link through THORChain's own transaction logs and any associated memo fields.
Centralized exchanges that later receive the BTC could theoretically freeze funds if law enforcement issues a timely request and the receiving address is identified, but that window narrows quickly once proceeds are further split or moved into self-custodial wallets. The scale of the alleged amount means even a partial recovery would be significant. For context on how institutional cross-chain liquidity flows are being watched more broadly, major derivatives venues are adding new perpetual contract products that create additional settlement and custodial surface area for investigators to track.
The following details are absent from available reporting and must be treated as unresolved: the specific wallet addresses holding the stolen ETH before the swap; the THORChain transaction IDs or block heights; the exact date and time of the alleged conversion; the current location of the resulting BTC; any response from Bitget's security team; and any THORChain governance or community action taken in response.
The $351.6 million figure should be treated as an estimate tied to a specific ETH price at an unspecified moment. Independent on-chain verification of the addresses and transaction path is necessary before the claim can be reported as established fact. Investigators and users should watch for any public disclosure of wallet addresses linked to the alleged theft, which would allow block explorer verification to begin in earnest.
According to unconfirmed reports, the alleged exchange involved ETH valued at approximately $351.6 million, though the exact token amount and the price used to derive that figure have not been disclosed in available sourcing.
The report names Ether (ETH) as the allegedly stolen asset and Bitcoin (BTC) as the asset received after the reported swap.
THORChain is named as the cross-chain protocol through which the alleged ETH-to-BTC conversion was routed. The protocol enables non-custodial native-asset swaps across blockchains without wrapped tokens. No specific transaction details on THORChain have been confirmed.
No. As of publication, no transaction hash, wallet address, block explorer link, or statement from Bitget or THORChain has been produced to independently verify the alleged swap. The claim requires on-chain corroboration before it can be treated as established.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post Bitget Hackers Swap $351.6M Stolen ETH for BTC via THORChain was initially published on Coincu.
