Bitget黑客在THORChain拒绝冻结请求后将630万美元转入比特币

与Bitget黑客关联的钱包通过THORChain将约630万美元ETH兑换为比特币，因交易所请求被拒

在THORChain拒绝交易所阻止与其9月24日漏洞攻击相关地址的请求后，一个与Bitget黑客关联的钱包通过该协议完成了约630万美元以太坊（ETH）到比特币（BTC）的兑换。

核心摘要：

• 该钱包完成了27次兑换操作，将约2,390 ETH转换为75.2 BTC。
• Bitget曾要求THORChain拒绝来自其已识别属于攻击者的地址的交易，但遭到拒绝。
• THORChain表示，其紧急控制措施可以暂停网络活动，但无法冻结特定的单次兑换交易。
• Bitget已将转移至攻击者控制地址的资产估值上调至3.875亿美元。

交易细节：ETH批量兑换及未成交情况

根据CoinDesk对THORChain交易记录的审查，这27笔完成的兑换将全部75.2 BTC发送至同一个接收地址。这些订单源自一个以太坊钱包，区块链追踪平台Lookonchain此前已将其认定为攻击者活动的一部分。当CoinDesk审查记录时，另有四笔涉及合计400 ETH的交易处于待处理状态。

此次兑换发生在周一UTC时间约03:55至06:23之间。大多数订单每笔涉及约100 ETH。按审查时的价格计算，CoinDesk将每批次价值估算为约26.5万美元。最终完成的交易将约2,390 ETH兑换为75.2 BTC；而那400 ETH的待处理交易并未包含在上述总数中。

记录还显示，该钱包在其设定的价格下存在可兑换量的限制。两笔100 ETH的订单仅部分成交，因为部分资金未达到交易设定的最低价格阈值。据CoinDesk审查，约有114 ETH被退回至发送钱包。

去中心化兑换机制与隐私交易路径

THORChain允许用户在不经过中心化交易所的情况下，交换持有在不同区块链上的资产。在周一的交易中，ETH进入兑换网络，而BTC则发送至比特币网络上的一个地址。由于转账的两端都保留在公共区块链上，即使资产跨越了链，调查人员仍能追踪记录下来的资金流动轨迹。

此外，攻击者已通过另一条途径将Bitget相关的比特币转入隐私交易。9月27日，区块链合规公司AMLBot追踪发现，约4枚BTC在资金从TRON移至Ethereum并通过THORChain后，进入了Wasabi CoinJoin混合轮次。AMLBot表示，其追踪结果将比特币与Bitget关联的TRON钱包联系起来。CoinJoin技术将多个用户的输入和输出合并到一笔交易中，使得直接匹配变得困难。

THORChain回应：紧急停机不能针对特定地址

Bitget首席执行官Gracy Chen在周末向THORChain提出请求，希望其拒绝服务Bitget已公布并正在追踪的地址。她在X平台（原推特）上发表帖子称：“去中心化是一项设计原则，而非协助已知被盗资金的盾牌。”她主张网络方应针对已确认的资金采取行动。

然而，THORChain拒绝了这一针对特定地址的封锁请求。在其公开回复中，团队指出，网络停机是用于保护协议的紧急工具，“并非对特定资金或单个兑换的选择性冻结”。团队表示，虽然其控制措施可以停止整个网络的兑换或限制连接区块链上的活动，但这些行动也会中断其他用户的交易。

安全公司GoPlus对THORChain对其可用控制措施的描述提出了质疑。正如9月27日报道的那样，GoPlus指出了THORChain文档中描述的验证者投票、签名控制和链特定暂停机制。GoPlus认为，这些机制为节点运营商提供了在资金面临风险时进行干预的途径。但THORChain坚持认为，其紧急停机旨在保护网络本身，而非作为特定钱包的黑名单工具。

Notably, the network used emergency controls in May this year, when an attacker stole approximately $10.7 million from a THORChain vault. Operators stopped activity until developers fixed the vulnerability, and transactions resumed in June, about five weeks later. THORChain said the addresses of the attackers in May were not individually blacklisted.

Bitget raised its valuation of losses and offered recovery rewards

Bitget initially estimated that the assets affected by the vulnerability on September 24 were approximately US$351.6 million. After taking into account Zcash and TRON assets that were omitted from the initial calculations, the exchange raised the value of assets transferred to attacker-controlled addresses to approximately $387.5 million. Bitget said the increase stems from a more thorough review of the original incident, rather than additional theft that occurred after the breach occurred.

Bitget detected an unauthorized transfer of funds at 18:31 UTC on September 24 and suspended the withdrawal service during the investigation. Bitget says its cold wallet remains safe. Subsequent updates noted that investigators had discovered and fixed the vulnerability, and that Mandiant and SlowMist were assisting with investigations and security inspections. Bitget has not released a full public explanation of how attackers gained access to its systems.

Subsequently, Chen announced a recovery reward plan, offering 5% rewards for eligible actions to freeze stolen assets and recover assets. Bitget released the addresses of the main attackers on Ethereum-compatible networks, XRP Ledger, Zcash and TRON, as well as panels used to track subsequent movements. The exchange said it will determine qualifications and payments based on each participant's contribution; work carried out pursuant to court orders or law enforcement requirements is not eligible for a reward.

For American readers, the recovery effort includes USDC publisher Circle. Bitget said Circle has frozen 99,990 USDCs related to the attack, while Tether has frozen 218,023 USDTs. These token freezes targeted identified stablecoin balances; THORChain responded to Bitget's independent request to stop ETH-to-BTC conversions. Bitget is still discussing future U.S. business, and Chen said in July that it would seek licenses and approvals before providing services to Americans.

Bitcoin withdrawal was the first to restart, and Bitget opened its service in stages

After completing the security check, Bitget formulated a phased withdrawal schedule. According to the announced plan, BTC withdrawals on the Bitcoin network should reopen at 08:00 UTC on September 28. ETH withdrawals (covering Ethereum, BNB Intelligent Chain, Arbitrum, Base and Optimism) are scheduled to resume at the same time at 08:00 UTC on September 29.

USDT提币（涵盖以太坊、BNB智能链、Solana和TRON）安排在UTC时间9月30日08:00。Bitget将其他代币、法币服务和点对点交易安排在最终阶段，定于10月2日进行。交易所建议客户查看其官方通知，以确认每项服务的可用性。