Bitget hack: how 40,551 ETH moved through THORChain to Bitcoin

Data as of September 29, 2026, 21:00 UTC. Every figure comes from public chain data. Full addresses are in the appendix. The full Strix investigation is public in CipherOwl Workbench.

On September 24, attackers drained Bitget's hot and warm wallets. Bitget first put the loss at $351.6 million, then raised it to $387.5 million after finding more transfers on Zcash and TRON. According to CEO Gracy Chen, no private keys were stolen. The attackers got into a backend system in the wallet infrastructure, fed it spoofed transaction data, and Bitget's own approval process signed the withdrawals. Bitget has said it suspects North Korean attackers.

For two days, most of the Ethereum proceeds sat still. Reporting on September 26 counted about 68,300 ETH idle across eight wallets while the BNB, TRX and XRP legs went through THORChain to Bitcoin. That changed on September 27. Over the next 45 hours the attacker peeled the parked ETH through 377 wallets and sent 40,551 ETH into THORChain in 1,485 deposits. THORChain paid out 1,238.49 BTC, about $103 million, to 36 Bitcoin addresses.

This post covers the EVM side of the $387.5M theft, the $162.8M that left Bitget on Ethereum, Arbitrum and Avalanche, and follows it into Bitcoin. The main point: THORChain writes the destination of each swap into the Ethereum deposit and the source of each payout into the Bitcoin transaction, so you can follow ETH into BTC hop by hop without guessing.

Key findings

• $162.8M reached the attacker's EVM wallet 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee on September 24: $126.5M on Ethereum, $19.7M on Arbitrum and $16.6M on Avalanche.
• The attacker sold $60.5M of USDT, USDC and tokenized gold for ETH in 21 minutes.
• 68,923 ETH sat in eight wallets for 2.5 to 4.5 days. All of it moved between September 27 and 29.
• 40,551 ETH went into THORChain (39,326 ETH after refunds) and came out as 1,238.49 BTC at 36 addresses. Between 36,546 and 38,872 ETH of that traces directly to Bitget's ETH, depending on the accounting method.
• One Bitcoin address received THORChain payouts from both stolen XRP and stolen ETH, which ties the two legs together on-chain.
• On the Bitcoin path we followed to the end, the BTC had not reached an exchange or mixer at the time of writing.

What this trace covers

Bitget's $387.5M total spans at least six chains. This post follows the three EVM chains into Bitcoin.

The remaining $30M or so hasn't been broken out publicly. Reports of stolen BNB suggest BNB Chain is part of it. EVM values use September 24 prices.

Day one: take it, then make it hard to freeze

The first transfer from Bitget to the attacker landed at 18:31:11 UTC: 0.84 ETH from 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23, which matches the time Bitget gave for detection. The large transfers came within 45 minutes: 34.75M USDT at 18:58, then 12.85M USDC, 3,000 XAUt and 7,131 ETH at 19:01, and 13,966 ETH at 19:16. Bitget's wallets also sent 19.67M USDT0 on Arbitrum at 19:01, 821,012 AVAX on Avalanche at 19:16 and 8.2M USDC on Avalanche at 20:55. The last Bitget transfer to the attacker came at 21:23.

An issuer can freeze USDT or USDC. Nobody can freeze ETH. The attacker moved the USDT, USDC and XAUt to a second wallet, 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c, and sold all of it in 22 transactions between 19:08:59 and 19:29:35, mostly through Uniswap. That turned $60.5M into 22,328 ETH in 21 minutes. The selling wallet is an ordinary account with an EIP-7702 delegation to a contract. By September 26, Circle and Tether had frozen about $318,000 connected to the breach.

The Arbitrum and Avalanche money came back to Ethereum through bridges. Five more wallets tagged to the exploit received funds through Circle's CCTP, Across, Stargate, deBridge, Mayan and Relay, then forwarded 21,714 ETH to a consolidator, 0xa6dd3f218b65e32ccc37be30f74884133c655545. The timing and sizes fit the Arbitrum and Avalanche legs coming home, though we haven't matched every amount end to end. CCTP alone minted 7.36M USDC to two of these wallets on Ethereum. One of them, 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946, is the same address the attacker used as its staging wallet on Arbitrum.

The consolidator collected 44,326 ETH and split it into four wallets of 10,000 ETH and a fifth that ended up with 4,326 ETH. The attacker's first wallet had already put 24,596 ETH into three more. By the morning of September 26, 68,923 ETH sat in eight wallets.

One warning for anyone repeating this trace. The attacker's wallets are surrounded by address poisoning: fake ERC-20 tokens with look-alike symbols, sent to addresses that share the first and last characters of the real staging wallets. A tool that follows token transfers without checking the token contract will follow the fakes. We excluded them.

Days three to five: peel, then THORChain

At 11:44 UTC on September 26, Bitget's CEO publicly asked THORChain to refuse service to the attacker's addresses. THORChain declined at 18:17 UTC, saying it is "decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain" and can't block a single address. XRP from the theft was already being swapped to Bitcoin through THORChain by then. The ETH started moving the next morning.

At 07:40 UTC on September 27 the first staging wallet began paying out. Over the next 56 hours, four distributor wallets made 506 transfers to 74 wallets, a median of 120 ETH each and about one a minute per distributor. Those wallets passed ETH down as many as six more hops, for 377 wallets in all. By 15:53 UTC on September 29 every staging wallet was empty.

The first THORChain deposits came at 17:29 UTC on September 27: three swaps totalling 312.94 ETH into USDC, paid to 0x577907e9eA2cc525C138D10dF273F2FFcA9e7573. Bitcoin-bound deposits started at 03:56 UTC on September 28 and ran until 14:33 UTC on September 29. In total:

• 1,485 deposits carrying 40,551.36 ETH.
• 93 of them refunded by THORChain, returning 1,225.37 ETH. Net: 39,325.98 ETH, or $105.9M at the price at each deposit.
• 1,238.49 BTC paid out to 36 Bitcoin addresses. Ten limit orders holding 390 ETH were still open at our snapshot.
• A median deposit of 11 ETH and a largest of 196.65 ETH. 83% were whole-ETH amounts.

Individual wallets had their own habits. 0x4a777646417b0fd34715d2b21d4a132c06aed330 made 740 deposits of about 10 ETH, one every 24 seconds at the median. 0xf7bc92103f23ef312658cd9b81dc2713f7b396c3 made 61 deposits of about 100 ETH. 0x132e00d513dc406342d2661cc74fb8542117afdd made 55 deposits of about 116 ETH, roughly every ten minutes. Each depositing wallet mostly paid one Bitcoin address of its own. The exception ties four wallets together: bc1qeqp6390m470cta7n8tpteqvp5lumswka2u8ezz received payouts from deposits by 0x5889433b754324089d4b6f168840fe5b13fe25df, 0x5c768bf29923f221bba75f2f3baab32d793eaea0, 0x944f912055ed2a1096f71fd16e89631de6422edf and 0xbc7c0f10eb697dbe156b0b62ef77a9bd2573757e.

Some depositing wallets also received ETH from outside the peel tree: swap settlements, bridges and other THORChain swaps. Those may be the attacker's own round trips, but we haven't confirmed it. Counting only ETH that traces straight back to Bitget, the attacker's THORChain volume is 36,546 to 38,872 ETH, depending on method.

Two ways into THORChain

481 deposits, 24,651 ETH, went through THORChain's router contract, 0xd37bbe5744d730a1d98d8dc97c42f0ca46ad7146, using its depositWithExpiry function. The other 1,004 deposits, 15,901 ETH or 39% of the total, skipped the router. They sent ETH straight to THORChain's vault addresses with the memo in the transaction's data field. Vault addresses rotate. A monitor that watches only the router would have missed 39% of the ETH and 68% of the deposits.

Reading the memos

Every THORChain swap carries a memo. =:b:<address>:<limit>/<interval>/<quantity> means: swap to Bitcoin, pay this address, pay out at least this much, and stream the swap in this many pieces. When the Bitcoin arrives, the payout transaction carries an OP_RETURN output that reads OUT: followed by the Ethereum deposit's hash. The link runs both ways. The deposit names the Bitcoin address before any BTC exists, and the Bitcoin transaction names the deposit that paid for it. Every one of the 1,485 deposits matched a record in THORChain's own data.

About three quarters of the memos also carry an affiliate tag, the field a swap interface fills in to take a fee. Here the fees ranged up to 125 basis points. That suggests most deposits were built through third-party swap front ends rather than hand-made contract calls. We haven't identified who runs those front ends.

Other exits

The peel wallets also placed CoW Swap sell orders for 15,539 ETH that named USDC, USDT and DAI as the tokens to buy; we haven't checked how many filled. A LayerZero multicall contract received 7,238 ETH. A fork of Uniswap's Universal Router with a built-in Across bridge module received 5,022 ETH, and 2,353 ETH of that went on to Chainflip, which can also swap into Bitcoin. Chainflip's total was 3,193 ETH. These are gross flows to the first contract the ETH touched. Some of it came back and left again, so the rows overlap.

At our snapshot, 45 of the 377 wallets still held 1,488 ETH, about $4.0 million.

On Bitcoin: one address, two stolen assets

The 36 payout addresses don't hold on to the BTC. Across their history they have received 1,928.8 BTC, including the 1,238.49 BTC from this trace. At Bitcoin block 969,205 they held 39.2 BTC. The rest has been forwarded.

We followed one of them all the way: bc1qh2mlug08tnm28xz6cj2cenvz6eyxj94t64g7pf, the largest payout address by ETH. It received 77 THORChain payouts totalling 200.06 BTC. Fifty-six of them name Ethereum deposits from 0x132e…afdd. The other 21 name XRP Ledger payments from rLAicwLC5NxfT7S7BQokNrtD5aXpifgWwF: 1,473,750 XRP swapped on September 26 and 27, before the ETH started to move. That account's XRP traces back two to three hops to rwNhefsz1UQEusxhCvHip3RANinWi4CTck, a wallet created at 19:01 UTC on September 24 and funded with 102.98M XRP by two accounts that XRPScan labels as Bitget, rGDreBvnHrX1get7na3J4oowN19ny4GzFn and rwTTsHVUDF8Ub2nzV2oAeWxfJzUvobXLEf. So one Bitcoin address collected the proceeds of stolen XRP and stolen ETH.

From there the address acts as an automatic forwarder. It made 42 payments to 14 collection addresses, one recipient per transaction. Each payment moved one-to-one to a new single-use address, usually in the same block. At block 969,192, 99.998% of the 200.06 BTC that reached it was still unspent, most of it sitting in those single-use addresses. We found no exchange, mixer or CoinJoin on this path. Other researchers have reported about 4 BTC from the TRON leg going through a Wasabi CoinJoin round, which is a separate path.

The 14 collection addresses also receive from other THORChain payout addresses, including three more of our 36 (bc1qchvvjltnfpkdfljdy8y47ednhuxvhq3k2dl4cj, bc1q5u7yn8hr4svhj9zuqtlvhwke7vn00jzlz65xff and bc1qxusgput28vpmedwexf86n2xawmdc3rqwpy0aea). They are a shared layer in the laundering, which makes them a good place to watch.

What compliance teams can take from this

Screen the memo, not just the address. A THORChain deposit memo names its destination in plain text. In this case all 36 Bitcoin addresses could be read from Ethereum calldata before any BTC arrived. For the address we followed to the end, that head start was between six minutes and seven hours.

Watch vault transfers as well as router calls. 39% of this attacker's THORChain volume never touched the router.

Use the OUT: memo as provenance. Bitcoin that descends from these payouts ties back to a specific Ethereum deposit through a hash written on-chain, not through clustering heuristics. That is evidence a compliance team can cite in a suspicious activity report or a freeze request.

Keep address poisoning out of the trace. Check the token contract before following a transfer. Look-alike tokens and look-alike addresses surround this case.

The window is still open. At our snapshot, the Bitcoin we followed was sitting in single-use addresses. If it reaches an exchange, the addresses in the appendix are the ones to match.

How we traced this

Strix, CipherOwl's investigation agent, built the first trace in CipherOwl Workbench from the four Bitget hot wallets. It kept following the funds for five days as they moved from Ethereum to Arbitrum, Avalanche and Bitcoin, and decoded the THORChain memos that link the chains. We then rechecked every figure in this post against raw chain data from Ethereum, Arbitrum, Avalanche, the XRP Ledger and Bitcoin, and against THORChain's Midgard API. The Workbench session is public, so you can follow the investigation as it happened; some of its early figures were revised in that recheck. We are tagging the addresses in this post in SR³ under the entity "Bitget Exploit 2026-09-24".

Snapshot. Ethereum block 26,085,667 (September 29, 20:58 UTC). Bitcoin block 969,192 for the payout-address trace and 969,205 for balances. Prices. Theft amounts use CoinGecko's September 24 prices (ETH $2,684.34). Current values use ETH $2,689.93 and BTC $83,523.59, both around 19:55 UTC on September 29. Scope. We followed transfers of more than 1 ETH. A deposit counts toward the THORChain total only if the depositing wallet had already received attacker ETH. Attribution. North Korean involvement is Bitget's assessment, not ours.

Disclaimer: This analysis is not complete and is provided on a best-efforts basis. It was compiled with Strix, CipherOwl's investigation agent, from public blockchain data as of September 29, 2026, 21:00 UTC, and the funds have kept moving since. Addresses, amounts and links between them may contain errors and may change as more data becomes available. Statements about who carried out the attack reflect Bitget's public disclosures, not an independent finding by CipherOwl. Nothing in this post is legal, financial or investment advice.

Appendix: indicators

Full addresses, grouped by role. Amounts are from this trace; an address can also hold or have received funds from other sources.

Bitget wallets (victim)

Attacker wallets: theft, swap, consolidation and staging

THORChain depositor wallets (25)

Sorted by ETH deposited. BTC is THORChain's actual payout.

THORChain contracts and vaults used

Bitcoin payout addresses named in THORChain memos (36)

Bitcoin collection addresses fed by bc1qh2ml…g7pf (14)

Each one forwards to new single-use addresses; the full list of those is available on request.

XRP Ledger attacker wallets

Sources

• Bitget, Security notice: Bitget hot wallet incident, September 24, 2026
• CoinDesk, Bitget's $352 million hack happened via spoofed transfers, not private keys, September 25, 2026
• Fortune, North Korea accused of plundering Bitget for $387 million, September 25, 2026
• The Crypto Times, THORChain rejects Bitget CEO's request to block hacker wallets, September 28, 2026
• Wublock, After the Bitget hack: THORChain's role in laundering stolen funds
• The Cryptonomist, Bitget hack investigation uncovers laundering trail and Bitget hack tracing finds 4 BTC laundered through a Bitcoin privacy tool