CoinDesk tracks ~2,390 ETH into 75.2 BTC on THORChain after Bitget refuse ask
By Crypto Wire
September 28, 2026
The Bitget fund trail printed a hard Monday number while retail BTC withdrawals were already reopening. CoinDesk, timestamped about 08:13 AM EDT (12:13 UTC) September 28, says a wallet linked to the Bitget attacker swapped about 2,390 ETH—roughly $6.3 million—into 75.2 BTC through THORChain on Monday, even as Bitget pressed the protocol to refuse tracked addresses. This UPDATE links the permissionless-reply chapter (9813) rather than silent-editing that URL.
What CoinDesk counted. The outlet’s read of THORChain’s public transaction records found 27 swaps marked successful, exchanging about 2,390 ETH for 75.2 BTC, with all bitcoin payouts going to one address. Four additional swaps involving 400 ETH were marked pending in the response CoinDesk reviewed. The orders sat between about 03:55 and 06:23 UTC Monday from an Ethereum wallet Lookonchain had flagged as part of the attacker’s activity, mostly in roughly 100 ETH batches (~$265,000 each at CoinDesk’s framing). Two 100 ETH orders were only partly filled after portions missed their specified minimum price, returning about 114 ETH to the sending wallet—company/protocol tape, not a desk re-simulation of Midgard fills.
Why the route matters for collectors. THORChain lets users exchange assets across chains without a centralized exchange account; stolen ether can become bitcoin in another wallet without hitting a CEX withdraw screen that could freeze the hop. The swaps stay publicly visible, which is how CoinDesk and on-chain desks keep following the peel. Bitget lost about $388 million in the September 24 breach per the desk’s reopen chapters, published attacker addresses, and offered a 5% bounty for eligible freeze/recovery work. CEO Gracy Chen’s weekend refuse-service ask on X—“Decentralization is a design principle, not a shield for facilitating known stolen funds”—is the policy fight; Monday’s ~$6.3 million ETH→BTC batch is the throughput print that updates it.
THORChain’s Monday framing, as relayed by CoinDesk. The project said a network halt is an emergency security mechanism “designed to protect the protocol” and “is not a selective freeze of specific funds or an individual swap.” Documentation-style controls can stop swaps broadly or restrict a connected chain such as Ethereum—but those levers would also interrupt other users on the affected routes. CoinDesk notes THORChain used emergency controls in May after about $10.7 million was stolen from one of its own vaults, with trading resuming June 22 after roughly five weeks, and says the May attacker’s addresses were never blacklisted. That distinction—protecting a compromised protocol versus refusing funds stolen from an outside exchange—is the core of Monday’s reply, not a new address blocklist.
How this differs from prior chapters. 9813 carried THORChain’s permissionless reply to Chen. Sibling reopen LNs (9902, 9908, 9916) cover retail BTC restore and AMA throughput—operational rails, not trail math. Today’s new fact is CoinDesk’s Monday tally: 27 successful ETH→BTC swaps, ~2,390 ETH / 75.2 BTC, one receive address, pending 400 ETH, and the halt-versus-blacklist clarification on the same day Bitget’s BTC ladder was live. Do not invent that THORChain blacklisted Bitget attacker addresses, that retail BTC withdrawals failed because of these swaps, or that the ~$6.3 million batch equals the full ~$388 million loss.
What not to invent: vendor names beyond what CoinDesk and Lookonchain attributed; that every pending 400 ETH order later filled; that Wasabi CoinJoin hops from earlier AMLBot chapters are proven in this same Monday batch; or that a protocol-wide halt is imminent. Stick to CoinDesk’s 12:13 UTC wrap, the 03:55–06:23 UTC order window, the successful-swap totals, Chen’s refuse-service ask, and THORChain’s selective-freeze denial. ETH reopen for Bitget retail still sits on September 29 on the hack-and-withdrawals tracker.
Bottom line: CoinDesk’s Monday read puts about 2,390 ETH (~$6.3 million) into 75.2 BTC via 27 successful THORChain swaps from a Lookonchain-linked Bitget attacker wallet—Rug Room UPDATE on the THORChain / Wasabi trail after 9813.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
