Bitget was hacked and generated fees of up to $761,725, researchers found

In the Bitget hacking incident, the funds laundering process incurred as much as US$761,000

According to independent researcher Andrey Sergeenkov, during the transaction flow process involving US$387.5 million in stolen funds from Bitget, relevant agreements and service providers charged a total of US$761,725. Among them, THORChain's liquidity providers received $573,226, MetaMask received $149,417, Chainflip received $26,751, and CoW EthFlow received $12,332.

Sergeenkov traced the flow of US$259,718 in THORChain linked fees to seven addresses that had additional funds linked to wallets used to transfer stolen funds. The largest associated address received $177,499, and part of its fee income was subsequently converted to USDT and eventually transferred to an address marked as OKX Hot Wallet.

Another $206,196 in fees went to other recipients, but Sergeenkov failed to establish additional financial connections between those recipients and the wallets involved in the transfer of stolen funds.

Detailed analysis: Profiting from Bitget's stolen assets

According to research data provided by Sergeenkov to the media, this analysis covers transaction records as of 10:22 UTC on October 2, focusing on reviewing the service platform used to exchange stolen assets and the fee receiving address marked in the THORChain exchange order. The discovery followed the theft of Bitget's hot wallets and Wynn wallets on September 24, and the exchange later estimated the loss at approximately $387.5 million.

Sergeenkov's calculations showed that THORChain's liquidity providers received $573,226 in exchange transactions involving stolen funds. In addition, MetaMask charged $149,417, Chainflip charged $26,751, and CoW EthFlow charged $12,332. The data is based on transaction logs presented in his research.

The analysis not only identifies the protocols used to handle these assets, but also separately examines THORChain's associated fees and traces how some receiving addresses interact with wallets used to transfer stolen funds.

THORChain Associated Fees Tracking

THORChain exchanges may include associated fees directed to independent recipients. Sergeenkov found that a total of US$259,718 in related fees flowed to seven addresses. Through analysis of subsequent transaction activity, he discovered what he called an "additional financial link" between the addresses and the wallets used to transfer stolen funds.

It should be noted that Sergeenkov's analysis does not claim that being labeled as an associated recipient proves that the address belongs to the attacker. An interface or script may insert the recipient's address before a user signs a transaction, such as when the service provider charges a referral fee. Therefore, the recipient field alone cannot determine the controller of the address.

Instead, he screened out recipients who provided other connection clues through transaction history:

• The largest associated address: Address thor18dvgrgpvxlh7 rhhld4 qjyrxs9c7 tvwdakrkjm4 received a handling fee of US$177,499. Sergeenkov linked it to money laundering through the main fund-sharing recipients.
• Second associated address: Another address received US$56,514 with the same type of connection.
• Third associated address: This address received US$18,080. Sergeenkov found that some of the fee proceeds were refunded to wallets that submitted one of the exchanges.
• Other related recipients: received US$4,544, US$2,885 and US$196 respectively. Another address received a fee of less than $1 and was subsequently transferred to another fee recipient in the analysis.

In some cases, different exchange operations specify different associated recipients, but send the main stolen funds to the same Bitcoin target wallet. Other transactions show fee revenue flowing back to exchange senders or between reviewed fee recipients.

Some of the fees eventually flowed into the OKX-marked wallet

Sergeenkov tracked the flow of funds beyond the THORChain level after receiving US$177,499 from the largest associated address mentioned above. A portion of the RUNE fee income is converted into USDT and then passed through two Ethereum wallets. According to research, funding eventually reached the address on Etherscan labeled "OKX Hot Wallet 5".

Sergeenkov表示，OKX可以利用其内部存款记录来确定这些转账是否对应客户账户，并识别持有人。然而，他的分析并未确立该账户的所有权，也未证实交易所客户是否参与了Bitget盗窃案。

这笔手续费追踪增加了Bitget漏洞发生后资产流动的另一个层面。此前报道指出，根据BlockSec在9月29日的快照，约有2.69亿美元通过THORChain进行了7,804笔交易。尽管这一数字代表的是通过价值，且可能包括同一笔资金多次通过该协议的情况。

随后，一个与Bitget相关的钱包完成了27次THORChain交换，将约2,390枚ETH转换为75.2枚BTC，当时价值约630万美元。

另外206,196美元流向无明确关联的接收方

Sergeenkov还确定了一组独立的THORChain关联接收方，他们从涉及被盗资金的交换中获得了206,196美元。但在其审查的交易历史中，未能将这些接收方与黑客钱包建立额外的资金关联。

这一区分是其分析的核心。第二组地址作为手续费接收方出现在已签署的交换指令中，但Sergeenkov未发现用于将第一组归入“关联类别”的那种额外资金流动。

In the unassociated group, the largest recipient was associated with the registered THORChain name "naswap" and received $102,344. A THORChain position account holding fees under multiple names, including w1, t, vi, ss, dx, ej, and symbiosis, received a total of US$92,438.

Another address associated with the name "tch" received $7,245, and the address using "ns" received $2,994. Another recipient received US$1,176. Sergeenkov said the final payment on the open account was not tracked in his analysis.

Industry Reaction and Summary

Sergeenkov's research came as Bitget and ThorChain publicly disagreed over whether the protocol should involve transactions involving the addresses of identified attackers. Bitget had asked THORChain to refuse service to addresses related to the breach, while THORChain said its emergency suspension mechanism was designed to protect network operations and did not provide a selective freeze on individual transactions.

Other service providers have taken a different approach. NEAR Intentions said its SHIELD system blocked more than $50 million in attempted transfers related to Bitget wallets and froze approximately $503,000 during execution. According to Alex Shevchenko, general manager of NEAR Intentions, approximately $166,000 had passed through before stopping suspicious traffic.

Sergeenkov's research focuses on the costs incurred in moving and exchanging stolen assets, rather than the amounts recovered or frozen. The total of $761,725 he counted consisted of fees earned by agreements and service providers from reviewed exchanges; while the two figures of $259,718 and $206,196 divided THORChain associated recipients into two groups based on whether transaction reviews uncovered additional financial links to wallets used to transfer stolen funds.