Bitget hack laundering generated $761,725 in fees, researcher finds

Protocols and services used to move funds stolen from Bitget have collected $761,725 in fees during the laundering process, while an independent researcher has traced $259,718 in THORChain affiliate fees to recipients with additional financial links to wallets involved in the swaps.

Summary

• Protocols and services collected $761,725 in fees from transactions used to move funds stolen in the $387.5 million Bitget hack, according to independent researcher Andrey Sergeenkov.
• THORChain liquidity providers received $573,226, while MetaMask collected $149,417, Chainflip received $26,751 and CoW EthFlow received $12,332.
• Sergeenkov traced $259,718 in THORChain affiliate fees to seven addresses with additional financial links to wallets involved in moving the stolen funds.
• The largest linked affiliate address received $177,499, with part of its fee income later converted to USDT and eventually transferred to an address labeled as an OKX hot wallet.
• Another $206,196 in affiliate fees went to recipients for which Sergeenkov did not establish additional financial links to the wallets involved in the stolen fund movements.

According to research shared with crypto.news by independent researcher Andrey Sergeenkov, the analysis covered transactions through Oct. 2 at 10:22 UTC and examined both the services used to exchange the stolen assets and the addresses named as fee recipients in THORChain swap instructions. The findings follow the Sept. 24 theft from Bitget's hot and warm wallets, which the exchange later valued at approximately $387.5 million.

Sergeenkov calculated that THORChain liquidity providers received $573,226 from swaps involving the stolen funds. MetaMask collected another $149,417, while Chainflip received $26,751 and CoW EthFlow received $12,332, according to the transaction data presented in his research.

The analysis goes beyond identifying protocols that processed the assets. Sergeenkov examined THORChain affiliate fees separately and traced how some of the recipient addresses interacted with wallets involved in moving the stolen funds.

THORChain affiliate fees reached $259,718

THORChain swaps can contain an affiliate fee that is routed to a separate recipient specified in the swap instruction. Sergeenkov found $259,718 in affiliate fees went to seven addresses where subsequent transaction activity provided what he described as additional financial links to wallets involved in the stolen fund swaps.

His analysis does not claim that being named as an affiliate recipient proves an address belongs to the attacker. An interface or script can insert a recipient address before the sender signs a transaction, including when a service collects a referral fee. Sergeenkov said the recipient field alone therefore cannot establish who controls an address.

Instead, he separated recipients where transaction history provided another connection.

The largest address in this category, thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4, received $177,499 in fees. Sergeenkov linked it to the laundering activity through shared recipients of the main funds.

Another address received $56,514 and had the same type of connection. A third collected $18,080, with Sergeenkov finding that some fee proceeds were returned to a wallet that had submitted one of the swaps.

Other linked recipients collected $4,544, $2,885 and $196. One address received less than $1 before transferring funds to another fee recipient examined in the analysis.

In some cases, different swaps that named different affiliate recipients sent the principal stolen funds to the same Bitcoin destination wallets. Other transactions showed fee proceeds moving back to a swap sender or between reviewed fee recipients, according to Sergeenkov.

Some fee proceeds eventually reached an OKX labeled wallet

Sergeenkov traced part of the $177,499 received by the largest linked affiliate address beyond THORChain.

Part of its RUNE fee income was exchanged for USDT and then passed through two Ethereum wallets. The funds eventually reached an address labeled "OKX Hot Wallet 5" by Etherscan, according to the research.

Sergeenkov said OKX could use its internal deposit records to determine whether the transfers corresponded to a customer account and identify its holder. His analysis does not establish who owns the account or whether the exchange customer was involved in the Bitget theft.

The fee trail adds another layer to the movement of assets following the Bitget breach. As crypto.news previously reported, roughly $269 million passed through THORChain across 7,804 transactions by BlockSec's Sept. 29 snapshot, although the figure represented pass through value and could include the same funds moving through the protocol more than once.

A Bitget linked wallet later completed 27 THORChain swaps, converting roughly 2,390 ETH into 75.2 BTC worth approximately $6.3 million at the time.

Another $206,196 went to recipients without established links

Sergeenkov identified a separate group of THORChain affiliate recipients that collected $206,196 from swaps involving the stolen funds but for which he had not established additional financial links to the hackers' wallets through the transaction history reviewed.

The distinction is central to his analysis. Addresses in this second group appeared in signed swap instructions as fee recipients, but Sergeenkov did not find the extra fund movements used to place the first group in the linked category.

The largest recipient in the unlinked group was associated with the registered THORChain name naswap and received $102,344. A THORChain holding account credited with fees under several names, including w1, t, vi, ss, dx, ej and symbiosis, accounted for $92,438.

Another address associated with the name tch received $7,245, while an address using ns collected $2,994. A further recipient received $1,176. Sergeenkov said final payouts from the holding account had not been traced in his analysis.

His findings arrived after Bitget and THORChain publicly disagreed over whether the protocol should intervene in transactions involving identified attacker addresses. Bitget had asked THORChain to refuse service to addresses linked to the breach, while THORChain said its emergency halt mechanisms were designed to protect network operations and did not provide a selective freeze for individual transactions.

Other services took a different approach. NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers linked to the Bitget wallets and froze approximately $503,000 during execution. Roughly $166,000 passed through before the suspected flows were stopped, according to NEAR Intents general manager Alex Shevchenko.

Sergeenkov's research concerns fees generated while the stolen assets were moved and exchanged, not the amount recovered or frozen. His $761,725 total consists of fees earned by protocols and services from the reviewed swaps, while the $259,718 and $206,196 figures identify two groups of THORChain affiliate recipients based on whether his transaction review found additional financial links to wallets involved in moving the stolen funds.