Bitget Attacker Swaps $6.3M in ETH for Bitcoin (BTC) via THORChain

Stolen Funds Split Across Two Routes

An attacker wallet linked to the September 24 hack of the Bitget exchange has started converting stolen funds into Bitcoin (BTC), and the trail so far sits on public ledgers. On-chain data shows an estimated $6.3 million in Ethereum (ETH) was swapped for BTC through THORChain, a cross-chain bridge protocol that settles asset exchanges across separate networks. Unlike the second route the attacker has opened, this one leaves a full public record: the ETH entering the swap contracts and the Bitcoin exiting them are both observable on-chain. No further movement of the swapped BTC has been reported, which leaves a latent seller overhang for the Bitcoin supply and, by extension, the Bitcoin (BTC) price picture. A second, harder-to-follow channel opened on Wednesday. Between 08:15 and 08:46 UTC on September 30, 2,746 ZEC, worth an estimated $3.9 million at the time, moved in three separate batches into Ironwood, the newest shielded pool on Zcash, a proof-of-work network that supports both transparent and shielded transactions. The amount represents roughly 15% of the 18,917 ZEC the attacker's wallet is estimated to have received in the breach. On-chain detective ZachXBT flagged the ZEC movement first, reporting that the funds had passed through two intermediate addresses that received ZEC from wallets Bitget has identified as attacker-controlled. Bitget has estimated its losses from the hack at approximately $387.5 million and says it is pursuing recovery of the stolen funds, though it has not disclosed how much of that total, if any, has been recovered so far. The pattern observed since Thursday suggests a split strategy: one portion of the loot routed through public cross-chain swaps, another portion pushed into privacy tooling built to break the trail.

Inside the Ironwood Shielded Pool

Zcash's Ironwood pool functions, in effect, as infrastructure for private on-chain payments: once ZEC enters, the sender, the recipient and the transaction amount are all hidden from public view. Investigators can still measure how much ZEC crosses from a transparent address into the pool, and they can measure what exits if the funds later return to public addresses, comparing entry and exit times, amounts and other metadata. What Zcash does not reveal is the transaction path connecting a specific deposit to a specific withdrawal. That gap is why the 2,746 ZEC that entered Ironwood on Wednesday morning cannot be traced the way a standard transparent-chain transfer can: the coins are confirmed inside the pool, but their next move, whenever it comes, will surface only as an unattributed exit amount. Timing metadata remains the main forensic lever; if the ZEC eventually exits in increments that mirror the deposit batches, the amounts become public again even without a linking path. The THORChain route used earlier left the opposite footprint. The estimated $6.3 million exchange that drained the attacker's Ethereum network balance into BTC recorded both legs on public ledgers, which is how investigators were able to reconstruct the flow at all. The two routes now frame the tracking problem: funds inside Ironwood are dark, funds moved through THORChain are visible but dispersed into Bitcoin, and roughly 16,200 ZEC, the balance of the stolen ZEC, has not been reported moving at all. Whether whale-sized blocks of ZEC resurface from the shielded pool is the detail recovery efforts will hinge on. For readers weighing venue risk after a breach of this size, our guide to the best crypto exchanges outlines the custody and proof-of-reserves checks worth running.

What Has Not Been Counted

The reading COINOTAG draws from the on-chain record is a laundering structure built on asymmetric visibility: one route trades transparency for speed, the other trades traceability for silence. Both figures are provisional estimates, not audited totals. As of Wednesday, 2,746 ZEC, about 15% of the stolen ZEC, is confirmed inside Ironwood, while roughly 16,200 ZEC has no reported movement and no destination has been disclosed for the roughly $6.3 million in BTC produced by the THORChain swaps. Until the shielded pool is exited or the Bitcoin resurfaces on a transparent ledger, the recoverable share of Bitget's estimated $387.5 million loss stays an open question.