Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH Hackers suspected of using THORChain to clean $351.6 million of stolen assets from Bitget
Hackers associated with the Bitget exchange reportedly stole $351.6 million, then used the THORChain protocol to route funds and convert Ethereum (ETH) to Bitcoin (BTC). The move was seen as a deliberate cross-chain asset transfer operation after the theft occurred.
Key facts about the $351.6 million theft
- Amount reported stolen: $351.6 million
- Asset conversion: ETH was converted to BTC after the theft
- Exchange platform: THORChain cross-chain protocol
According to circulating reports, attackers stole a total of $351.6 million in assets from wallets associated with Bitget, making this one of the single large-scale exchange thefts reported in 2026. Blockaid data shows that in the first half of 2026 alone, more than $1 billion in assets were stolen from crypto protocols, highlighting the continued momentum of exchange-level exploit activity this year.
After the preliminary theft, the reported money laundering route involved exchanging held ETH for BTC through THORChain. All claims related to this incident stem from unconfirmed reports; as of press time, this article has not independently verified any on-chain transaction hashes or blockchain browser records.
Path resolution of ETH converted to BTC through THORChain
THORChain 是一个去中心化的跨链流动性协议，允许用户在不包装代币或不依赖中心化中介的情况下，在不同区块链之间交换原生资产。通过 THORChain 执行的兑换不会抹除公共区块链上的交易记录；发出的 ETH 交易和收到的 BTC 交易都会分别保留在其各自的区块浏览器记录中。
ETH 与 BTC 的区别对盗窃后的追踪至关重要。以太坊可编程的交易模型允许在合约级别标记 ETH 流向；而比特币基于 UTXO（未花费交易输出）的结构则使得自动化聚类分析变得复杂。通过跨链协议将 ETH 转换为 BTC，会将分析负担从以太坊工具转移到比特币链分析上，要求调查人员关联两个独立账本的活动，而非单一账本。
跨链兑换引入了法医追踪轨迹中的“接缝”。每个区块链都维护其独立的记录，链上分析公司必须协调这些记录，以重新链接兑换前的 ETH 地址与兑换后的 BTC 地址，这比同链转账增加了复杂性。
为何跨链洗钱加剧了安全与追踪的难度
The reported $351.6 million in financial flows follows a recurring post-theft pattern: stolen assets are routed through decentralized, cross-chain locations, followed by fragmented forensic tracking. State-backed actors have used similar tactics to move millions of dollars worth of BTC positions after converting other assets into Bitcoin, taking advantage of the characteristics of Bitcoin's pseudo-anonymous ledger structure.
Public blockchain ledgers remain fully auditable; when combined with protocol-level data and address clustering heuristics, blockchain analytics companies can track cross-chain redemption events. THORChain's own on-chain records are publicly accessible, which means that redemption steps are not hidden, but scattered across different chains. Investigators handling the case will refer to the origin data on the Ethereum side and the target block browser records on the Bitcoin side.
For exchange operators, the case once again highlights the risk of exposure of hot wallets as the main attack surface. Cold storage isolation, multi-signature withdrawal authorization, and real-time anomaly detection of large outbound traffic are standard mitigation measures. Previous high-profile capital flow cases from platforms such as Hyperliquid have shown that large amounts of money can be quickly withdrawn from agreements before testing triggers.
Custody concentration remains a key client-side risk indicator: funds deposited on a single centralized exchange face counterparty risks to the platform's security posture. Total losses in the first half of 2026 suggest that decentralizing custody into cold wallets and multiple platforms has become an uncompromising risk management step.
截至发稿时，尚未有关于此次盗窃案的确认恢复情况、攻击者身份或执法行动的报告。随着调查的深入，追踪大型跨链流动的区块链分析公司可能成为下一步链上归因数据的主要来源。
