Bitget hackers swap Ethereum for Bitcoin via THORChain — What’s happening?

The Bitget episode on 24th September led to $351.6 million being drained. Its culprits have now started to swap Ethereum for Bitcoin via THORChain.

Pseudonymous blockchain investigator ZachXBT reported that funds linked to the exploit are being chain-hopped through bridges and moved towards mixing services such as Wasabi.

For perspective, in chain-hopping, stolen assets are moved from one blockchain to another. This, while mixing services, is designed to make it harder to connect specific transactions with the original source.

How did Bitget attackers drain and launder funds?

ZachXBT further alleged that Chinese-speaking illicit actors are helping move the funds. And, for this they are seeking assistance through public Discord and Telegram channels. 

In fact, according to a previous report by AMBCrypto, Gracy Chen claimed that the attack was likely linked to a North Korean group, citing matching IP and VPN patterns. 

In a 28th September livestream, Bitget’s Chen divulged that the attackers obtained high-level internal credentials through this vulnerability and used them to access Bitget’s wallet backend. The attackers then inserted fraudulent withdrawal commands that bypassed normal risk controls, allowing roughly 380–387.5 million in assets to be transferred out.