THORChain Liquidity Earned $573,000 From Bitget-Linked…

Swaps used to move funds stolen in Bitget's September breach generated at least $761,725 in identifiable fees for crypto protocols and routing services, according to independent on-chain researcher Andrey Sergeenkov. His dataset covers assets traced from the Sept. 24 attack through Oct. 2. Bitget has said about $387.5 million was taken after attackers compromised a third-party security product and manipulated the exchange's withdrawal infrastructure without obtaining private keys.

THORChain liquidity fees dominated the measured sample at roughly $573,226, or 75.3% of the total. MetaMask-related fees accounted for another $149,417, Chainflip broker fees came to about $26,751, and executed protocol and partner fees tied to CoW EthFlow contributed some $12,332. The calculation uses historical dollar prices, excludes separate BNB Smart Chain fees and does not allocate THORChain liquidity fees among individual liquidity providers, so the figure reflects recorded charges rather than net profits or a complete list of economic beneficiaries.

Affiliate payments and the limits of attribution

THORChain swaps can carry an affiliate identifier and fee that an interface or routing service inserts before a user signs a transaction, meaning a recipient's presence in a hacker-linked swap is not evidence the attacker owns that address. Sergeenkov therefore split recipients by whether further transaction links could be found. Seven recipients collected about $259,718 while showing additional financial connections to laundering wallets, led by one that received roughly $177,499 and another that took in about $56,514.

Some links were stronger than others. A recipient earning about $18,080 later converted part of its RUNE fees and sent proceeds to a wallet that had submitted swaps using that affiliate identifier; that wallet subsequently received ETH connected to Bitget's compromised-address cluster. A smaller recipient earning roughly $196 converted accumulated RUNE into ETH and directed it back toward the address that had generated the fees. Such flows create investigative leads but do not establish common ownership or intent.

The largest linked affiliate route also produced a possible off-chain lead: part of one recipient's RUNE fees was converted into USDT and moved through two Ethereum wallets to an address Etherscan labels as an OKX hot wallet. That does not show OKX received stolen assets, but it marks a point where tracing could meet exchange customer records. Separately, about $206,196 in THORChain affiliate fees and credits went to recipients with no additional hacker-related links by the Oct. 2 cutoff, including roughly $102,344 tied to the THORName "naswap" and about $92,438 in a holding account associated with several names.

Earlier reporting on the breach tracked more than $83 million in stolen XRP and debate over THORChain's refusal to block hacker-linked transactions. A Chainflip broker previously rejected a Bitget-linked transaction before the funds could enter that protocol, showing some access points can screen flows even on permissionless networks.