Bitget Hack Laundering Generated $761K in Fees, Researcher Finds

Protocols and services used to launder funds stolen in the $387.5 million Bitget hack have collected $761,725 in fees, according to research by independent analyst Andrey Sergeenkov. The analysis, which covered transactions up to October 2, examined the decentralized platforms and services utilized by the attackers to exchange and route the stolen assets following the September 24 exploit of Bitget's hot and warm wallets.

Protocol Fee Breakdown

According to the research shared with CryptoNews, THORChain liquidity providers were the largest beneficiaries, capturing $573,226 from swaps involving the stolen assets. The self-custodial wallet MetaMask collected $149,417 in fees, while decentralized routing protocols Chainflip and CoW EthFlow received $26,751 and $12,332, respectively.

In addition to protocol-level fees, the researcher analyzed THORChain affiliate fees, which totaled $259,718. Sergeenkov traced these fees to seven specific addresses that exhibited additional financial links to the wallets executing the swaps. The largest linked affiliate address received $177,499, with a portion of its RUNE fee income subsequently converted to USDT and transferred to an address labeled as an OKX hot wallet.

Unlinked Fees and Protocol Responses

An additional $206,196 in affiliate fees went to recipients for which the researcher could not establish direct financial links to the attacker's wallets. The largest unlinked recipient was associated with the registered THORChain name "naswap," which received $102,344.

The findings follow a public disagreement between Bitget and THORChain over transaction intervention. Bitget had requested THORChain to selectively freeze transactions linked to the exploit. However, THORChain stated that its emergency halt mechanisms are designed strictly to protect network operations rather than freeze individual user transactions. In contrast, NEAR Intents successfully blocked over $50 million in attempted transfers using its SHIELD system.

Key facts

• Protocols and services collected $761,725 in fees while processing stolen Bitget funds.
• THORChain liquidity providers received the largest share of fees at $573,226.
• Researcher Andrey Sergeenkov traced $259,718 in affiliate fees to seven linked addresses.
• A portion of the affiliate fees was converted to USDT and sent to an OKX hot wallet.
• NEAR Intents blocked over $50 million in attempted transfers linked to the hack.