Bitget hack: the last 40,000 ETH has moved — about 35,000 ETH sent toward THORChain

Most coverage has stopped at “the XRP went through THORChain into bitcoin”. We read the XRP Ledger to the swap itself. On 24 September two Bitget wallets sent 102,976,680 XRP to rwNhefsz1UQEusxhCvHip3RANinWi4CTck, which split it into four wallets of 20 million and one of 22,976,677, as reported at the time.

From 25 to 27 September those five wallets paid everything out in 479 payments to 60 fresh accounts — accounts the attacker’s own wallets had activated hours earlier, each left with the 1 XRP reserve. From those 60 accounts, 73.4 million XRP went straight into THORChain’s XRP vaults in 1,132 swaps between 25 and 28 September. Each swap carries a memo naming where the bitcoin should be paid, so the destination is not a guess: 28 Bitcoin addresses, most of it to five of them (bc1qvmnnu4… alone was named in 228 swaps for 21 million XRP). The remaining ~29.6 million XRP went through further layers of fresh accounts before the same exit; we stopped following where the trail mixed with exchanges’ own wallets.

Those 28 Bitcoin addresses received 1,924.8 BTC in total — more than the XRP alone would buy, because some of them were also named in THORChain payouts that did not start on the XRP Ledger: the same bitcoin wallets collected more than one leg of the theft. All 28 are empty. Each was swept on in single-output transactions to further fresh addresses; there is nothing left at that step to freeze, and XRP itself cannot be frozen by anyone. We marked all 28 Bitcoin addresses in our database; XRP Ledger addresses we cannot mark, because we do not index that chain.

On chain there is nothing left to watch on the wallets this page mapped. We re-read all of them on 7 October: the first wallet, the swap wallet, the hub and the eight holding wallets together hold less than one ether of dust. The one balance that has not moved is the $318,013 in USDT and USDC frozen on 0xe07Bd590E1198666230932BAd5db3DbBE21e7d57.

Bitget says about $1.1 million has been frozen in total, out of roughly $387.5 million taken; the frozen wallet above is a bit under a third of that. The exchange has not said how much, if anything, has come back, and its chief executive Gracy Chen has said she does not expect a significant share to be recovered.

On how it happened: Bitget, citing SlowMist’s investigation, says the attackers used a zero-day flaw in a third-party security product, and that the earliest malicious activity in its logs dates to 31 August — more than three weeks before the withdrawals of 24 September.

On who: Chainalysis has attributed the theft to North Korea-linked actors, which by its count takes that group’s 2026 total past $1 billion. That attribution is theirs. Nothing we read on chain names anyone, and this page does not.

The four wallets of exactly 10,000 ETH did not wait long. 0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0 sent its 10,000 ETH to the layering hub 0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2 at 18:55 UTC on 28 September, and 0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272 did the same at 01:14 on 29 September. 0xFd5EBe912e2061992437767e24e5BCb52a3f9e54 was emptied between 07:59 and 11:38 in 74 transfers, and 0xeD5a394a7558929112848B7e97B569de6bbE1A51 between 11:43 and 15:53 in 69, into 17 fresh wallets. None of the eight original holding wallets holds anything now.

Since 18:55 UTC on 28 September the attacker’s wallets have deposited 18,354 ETH straight into THORChain’s router in 329 transactions, and sent another 6,402 ETH straight to THORChain’s own vault addresses. Together with the first wave, about 35,000 ETH — roughly $93 million — has now been sent toward THORChain and on to Bitcoin. About 11,000 ETH more was sold through CoW Swap. The layering hub 0x600cfeDc… turned out to be a pass-through, not a separate route: about 39,000 ETH went through it in total, and 34,627 ETH of that went straight to wallets whose exits are already counted above. The remaining ~4,400 ETH went through another layer of fresh wallets; about 1,200 ETH of it was sold via CoW Swap and the rest is still moving hop by hop.

Some of it has been stopped. Tether and Circle froze $318,013 in USDT and USDC on 0xe07Bd590E1198666230932BAd5db3DbBE21e7d57 — the wallet this page flagged as still freezable on 25 September. NEAR Intents says its SHIELD system rejected more than $50 million in attempted transfers, froze about $503,000 mid-trade and let about $166,000 through. THORChain has said it cannot block individual addresses.

On the Bitcoin side ZachXBT reports that the funds are being chain-hopped and deposited into mixers such as Wasabi, and that Chinese laundering operators working for the attackers openly ask services for help with their orders on Discord and Telegram. Bitget has said the attacker used a zero-day vulnerability in a third-party security product to obtain high-level internal credentials. Neither is our finding; both are theirs.

Three days after the theft the attacker began moving the parked ETH. At 07:40 UTC on 27 September the holding wallet 0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899 was emptied in 75 transfers to fresh addresses. On 28 September the 4,596 and 4,326 ETH on two smaller holding wallets were merged into 0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2, which then paid out in more than a hundred transfers. In two days 26,394 ETH (~$70M) left the holding wallets and passed through 245 fresh intermediate wallets, none of them used before.

Where it went, in order of size: about 9,000 ETH into THORChain — directly, and through direct transfers to THORChain’s vault addresses (an earlier version of this page called those vaults "feeder wallets" of the attacker; they belong to THORChain); about 6,600 ETH through a LayerZero/Stargate bridge contract; about 7,700 ETH swapped on CoW Swap, Uniswap and 0x; about 1,800 ETH through Skip Go to Cosmos chains; about 1,800 ETH through an "OnchainGateway" contract; smaller amounts through Across, Umbra and Railgun. Part of the swapped ETH came back to the same wallets and was sent on again, so these figures overlap by up to ~5,400 ETH and are best read as shares, not a ledger.

Bitget has since raised its loss estimate to $387.5 million and asked THORChain to refuse service to the attacker’s addresses; THORChain declined, saying it cannot freeze individual addresses (CoinDesk, 28 September, which counted 27 swaps of about 2,390 ETH into 75.2 BTC by that point). Our count covers the whole layering cluster and every route, not only THORChain.

THORChain is the route that ends in native Bitcoin, and it is the one the largest exchange thefts of recent years were laundered through. It was reached within hours, before any of the four remaining 10,000 ETH wallets was touched: 0x9FA39d62…, 0xA6BFd7Fc…, 0xFd5EBe91… and 0xeD5a394a… still held 40,000 ETH at that point; they moved on 28–29 September (see above).

All 245 wallets of this layering are labelled in the PublicAML risk graph and listed on our incident page, so any service screening against it will see them.

Bitget says unauthorized transfers began at 18:31 UTC on 24 September and first said that $351.6 million left its hot and warm wallets — a figure it later raised to about $387.5 million once Zcash and Tron assets were counted; it froze withdrawals for all users and has not named a final attack vector. Early on-chain estimates of $174–192 million covered only the EVM chains. The gap was closed by Lookonchain’s breakdown: 102.93 million XRP (about $157 million) is the largest single asset, ahead of ETH, stablecoins, XAUT, BNB, AVAX and TRX. The XRP route has been followed by bitcoin.com and others. None of that is ours, and this page does not repeat it.

The attacker’s first wallet on Ethereum is 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. It received a 0.84 ETH test from Bitget 6 (0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23) at 18:31, then 34,751,168 USDT, 12,852,046 USDC and 9,234 ETH from the same wallet, and 3,000.32 XAUT from Bitget 5, 0x5bdf85216ec1e38D6458C870992A69e38e03F7Ef.

The larger share of the ETH came from a third wallet, Bitget 35 (0xffa8DB7B38579e6A2D14f9B347a9acE4d044cD54, labelled so on Etherscan and topped up by Bitget 6 in the normal course of business): 15,361.83 ETH in three transfers at 19:03, 19:16 and 20:09. Taken together, the attacker pulled 24,596.6 ETH straight out of Bitget on Ethereum.

USDT and USDC can be frozen by their issuers, ETH cannot. Between 19:07 and 19:46 the attacker moved the stablecoins and the gold token to a wallet running an EIP-7702 delegation, 0x7c96279Ec1e888Aa56b9B836e0dB26ca48573E1C, and sold them through UniswapX Dutch orders and Uniswap pools for 22,612.7 ETH. That ETH went to a hub, 0xA6dD3F218B65E32Ccc37BE30f74884133c655545, in two transfers (22,320 and 292 ETH).

The same hub then collected about 21,000 ETH more from wallets that received it through bridges — Stargate, Across and deBridge — and from swaps on Ethereum. The attacker used the same addresses on Arbitrum, BNB Chain, Avalanche, Base and Optimism; on 25 September they hold almost nothing there. Everything that was converted has been brought home to Ethereum.

From the first wallet and from the hub the ETH was cut into round lots and parked: six wallets of exactly 10,000 ETH, one of 4,596.47 and one of 3,698.10. Together with 170 ETH left on a bridge intake that is 68,465 ETH, about $183 million at the 25 September price. Not one of the holding wallets has sent a transaction since it was filled.

The eight holding wallets, as of 25 September: 0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0, 0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272, 0xFd5EBe912e2061992437767e24e5BCb52a3f9e54, 0xeD5a394a7558929112848B7e97B569de6bbE1A51, 0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899, 0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2 (10,000 ETH each), 0xDc2901f741B4003e32B8B752e97b8c4C1891dC63 (4,596.47 ETH) and 0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284 (3,698.10 ETH).

One intake wallet, 0xe07Bd590E1198666230932BAd5db3DbBE21e7d57, still holds 218,023 USDT and 99,990 USDC. Those two can still be frozen by Tether and Circle.

The attacker is being targeted in turn: look-alike addresses sharing the first and last characters of the attacker’s wallets (0x7C93…3e1C for 0x7c96…3E1C, 0xA6DD…, 0xDc29…) have been sending zero-value transfers and fake “ETH” and “USDT” tokens to them. That is address poisoning, aimed at whoever copies an address from the history next.

It names nobody. Bitget has pointed to a North Korea-linked group but called that unconfirmed; this page adds nothing to it. An on-chain investigator has linked the XRP routing to July’s AFX exploit. We checked the Ethereum side for that link — two hops out from the AFX exploiter’s wallet 0x627654B2782BFc57580ecd11d40869B350b6EBaC — and found no shared address, which neither confirms nor rules it out.

All 20 attacker addresses on Ethereum are labelled in the PublicAML risk graph and listed on our incident page. The holding wallets are watched: the page will be updated when any of them moves.