A wallet associated with the Bitget hack exchanged roughly $6.3 million worth of ether for bitcoin through THORChain on Monday, even as Bitget urged the decentralized swap network to reject transactions involving addresses linked to the $387.5 million theft.

CoinDesk identified 27 completed transactions in THORChain’s public records, with approximately 2,390 ETH exchanged for 75.2 BTC. The bitcoin from each completed swap was sent to the same receiving address. Another four transactions, representing 400 ETH, remained pending in the records reviewed.

The transactions were initiated between approximately 03:55 and 06:23 UTC Monday from an Ethereum wallet that blockchain tracker Lookonchain had attributed to the attacker. Most of the swaps were submitted in batches of around 100 ETH, valued at approximately $265,000 each.

Hacker Uses Cross-Chain Swaps

THORChain allows users to exchange cryptocurrencies across separate blockchains without relying on a centralized exchange account.

That makes it possible for an attacker to send stolen ETH into the protocol and receive BTC in a different wallet without interacting with a centralized platform that could potentially block the funds. The transfers remain recorded on public blockchains, however, giving investigators a way to track the assets as they move between networks.

Bitget was hit by a breach on September 24 that resulted in approximately $388 million in cryptocurrency being stolen. The attacker bypassed security measures protecting the exchange’s wallets.

Bitget later said it had identified and resolved the vulnerability responsible for the incident. The company has not publicly provided details about how the attacker gained access.

Bitget Appeals to THORChain

Bitget subsequently published addresses connected to the attacker and offered a 5% bounty for qualifying efforts aimed at freezing or recovering the stolen assets.

As the hacker began transferring the funds through other services, Bitget CEO Gracy Chen publicly asked THORChain to stop processing transactions from those addresses.

Chen said the wallets were already publicly identified and actively monitored. She called on THORChain to refuse transactions involving the addresses, arguing that decentralization should not serve as protection for moving known stolen funds.

THORChain responded by explaining that its emergency controls do not function as an address-level blacklist.

The network said its halt mechanism exists to protect the protocol during security emergencies rather than selectively freeze particular funds or stop an individual swap.

Halting a Chain Can Affect Other Users

THORChain’s documentation gives operators the ability to suspend swaps throughout the network or restrict transactions involving a specific connected blockchain.

For instance, activity involving Ethereum can be halted, but such a measure would also prevent legitimate users from completing transactions through the affected route.

THORChain used its emergency controls in May after an attacker stole approximately $10.7 million from one of its own vaults. Those vaults hold assets needed to support cross-chain swaps.

The network was shut down while developers investigated the exploit and repaired the vulnerability. Trading resumed June 22, about five weeks later.

THORChain said it did not blacklist the wallets involved in that attack. Instead, the shutdown was used to protect the protocol itself, unlike Bitget’s request, which seeks restrictions on funds stolen from an external exchange.

Swap Limits Disrupt Some Transactions

The hacker did not complete every attempted swap on Monday.

Two 100 ETH orders were only partially filled after some portions failed to satisfy the minimum price requirements. Around 114 ETH was subsequently returned to the sending wallet.

The activity highlights the distinction between tracing and controlling cryptocurrency flows. Public blockchain records allow investigators to follow assets moving through THORChain, but the network’s decentralized structure does not provide the same selective account-freezing capabilities as a centralized exchange.