The Bitget Hacker Isn't Hiding, They're Washing $388M in Real Time
While Bitget quietly resumed Bitcoin withdrawals this week, the attacker behind last week's $388 million hack is still moving funds, swapping stolen ETH through THORChain's cross-chain routing protocol as you read this.
This isn't a story about an exchange coming back online. This is a story about a live, active exploit aftermath that the broader market hasn't fully priced in.
What Actually Happened
Bitget suffered one of the largest centralized exchange hacks of the year, with $388 million drained in what the exchange described as a security breach. The platform immediately froze withdrawals across all assets to contain the damage and trace the funds.
Bitcoin withdrawals resumed first. Ether withdrawals are scheduled to return Tuesday. USDt follows on Wednesday. The phased rollout signals Bitget is stabilizing, but it also signals that ETH-side exposure is still being evaluated, which is exactly the window the hacker is exploiting.
Why THORChain Matters Here
THORChain is a decentralized, cross-chain liquidity protocol that allows users to swap native assets across blockchains without a centralized intermediary. It has appeared in the aftermath of multiple high-profile hacks precisely because it is difficult to censor and leaves minimal KYC trail.
By routing stolen ETH through THORChain, the attacker is converting funds across chains in a way that fragments the on-chain trail, making asset recovery significantly harder for blockchain forensics firms and law enforcement. This is not a new playbook. It is the same route used after the Ronin and Harmony bridge exploits.
What the Market Is Missing
Most headlines are framing this as a recovery story. Withdrawals resumed, exchange is back, move on. But the hacker moving funds actively through a live protocol is a systemic signal that deserves attention.
First, THORChain liquidity pools absorb volume regardless of the source, which means protocol-level metrics may spike without reflecting organic demand. Second, any coordinated response from regulators targeting THORChain, similar to the Tornado Cash precedent, could have immediate and severe consequences for DeFi infrastructure broadly.
Third, Bitget's ETH withdrawal freeze extending to Tuesday suggests internal exposure to the ETH side of this hack is not fully resolved. Watch that Tuesday window carefully.
What Traders Should Watch
Monitor THORChain swap volume and any on-chain alerts from firms like Chainalysis or Arkham flagging the hacker's wallet clusters. If regulatory action against THORChain gets triggered, expect DeFi tokens to reprice fast.
For Bitget users specifically, the Tuesday ETH withdrawal resumption is the real stress test. If it slips, the recovery narrative falls apart quickly.
This is not over. It is just moving chains.