THORChain refuses Bitget's request to block the hacker, who swaps 2,390 ETH for 75 bitcoin, under 4% of the stash

A wallet tied to last week's $387.5 million Bitget hack converted about 2,390 ether into 75.2 bitcoin through THORChain early Monday, and the swap network turned down Bitget's public request to stop it, CoinDesk reported. CoinDesk counted 27 completed swaps between about 03:55 and 06:23 UTC, mostly in batches of about 100 ETH, with all the bitcoin sent to a single address and four more swaps totalling 400 ETH still pending.

Why THORChain says it cannot help

Bitget chief executive Gracy Chen asked THORChain on X over the weekend to "refuse service" to the attacker's published addresses. THORChain replied that its network halt "is an emergency security mechanism designed to protect the protocol" and "is not a selective freeze of specific funds or an individual swap." Its operators can stop trading across all chains, or on one chain such as Ethereum, but that would block every other user on those routes too, CoinDesk reported. The protocol has no built-in address blacklist, crypto author Anndy Lian told Cointelegraph.

THORChain did halt in May, for about five weeks, after an attacker took roughly $10.7 million from one of its own vaults. It says that was protecting a broken protocol, not blocking someone else's stolen money, and that the May attacker's addresses were never blacklisted either.

The number behind the $6 million

Monday's swaps look large in a headline and small against what is left. Last week CoinDesk, citing MistTrack, reported that attacker addresses still held more than 63,000 ETH. The 2,390 ETH moved Monday is about 3.8% of that (our calculation). At 100 ETH a batch, clearing the rest the same way would take about 630 more swaps.

It also is not free for the attacker. The swaps worked out to about 31.8 ETH per bitcoin, while Coinbase prices on Monday morning, around $2,688 for ether and $83,500 for bitcoin, imply about 31.1. That gap means roughly 2.2% of the value was lost to fees and slippage, on our rough calculation using prices from a few hours after the swaps. CoinDesk also found two 100 ETH orders only partly filled because they missed their minimum price, sending about 114 ETH back to the wallet. THORChain will not block the money, but its pool depth limits how quickly it can move.

What it means for Bitget users

None of this changes the exchange's own balances. Bitget says its cold wallets were untouched and it resumed bitcoin withdrawals Monday, with ether due Tuesday, USDT on Wednesday and other assets and peer-to-peer services on Friday, Cointelegraph reported. Chen said the order applies to every user, with no priority for institutions, VIP customers or staff. Bitget has also offered a 5% bounty for help freezing or recovering funds, which would be up to about $19.4 million on the full $387.5 million.

For traders, the case is a live test of the line THORChain drew: it will halt to protect itself, but not to police other people's losses. Background: Bitget's reopening schedule and its protection fund math.

Sources: CoinDesk, Cointelegraph, Coinbase Exchange. Share of holdings, swap cost and bounty size are our calculations. This is market information, not investment advice.