Who Earned Fees From the Laundering of Bitget’s Stolen Funds
Laundering Bitget’s stolen funds generated fees:
- $761,725 for protocols and services.
- $259,718 for THORChain affiliates with additional financial links to the hackers’ wallets.
- $206,196 for affiliates with no such links established yet.
On September 24, 2026, funds were stolen from Bitget’s hot and warm wallets. Laundering the stolen funds generated fees for the protocols and services used to move and exchange them. The chart below shows which protocols and services benefited and how much they earned in fees.
Protocol and service fees from swaps of Bitget’s stolen funds
Data through
| Fee category | USD | Share |
|---|---|---|
| THORChain liquiditySwap liquidity fees | $573,226 | 75.3% |
| MetaMaskTransfers to the Ethereum fee recipient | $149,417 | 19.6% |
| ChainflipBroker fees on matched swaps | $26,751 | 3.5% |
| CoW EthFlowExecuted protocol and partner fees | $12,332 | 1.6% |
Fee Recipients Linked to the Bitget Hackers’ Wallets
THORChain swaps can include a separate affiliate fee. The parties moving Bitget’s stolen funds signed swap instructions naming the fee recipients. Those recipient addresses provide a starting point for tracing financial links to the hackers’ wallets. An interface or script can insert the recipient before the sender signs, for example to collect a service’s referral fee. Naming a recipient therefore does not, by itself, establish who controls that address.
The reviewed transactions document additional financial links for the recipients below. Some recipients returned fee proceeds to a wallet that submitted a stolen-fund swap or transferred funds to another linked fee recipient. In other cases, swaps naming different fee recipients sent the main stolen funds to the same Bitcoin destination wallets. The “Evidence” entries show the transactions supporting each link.
THORChain Fees Received by Addresses Linked to the Bitget Hackers’ Wallets
Affiliate fees with additional links through fund movements
Data through
All address tables use the same linear fee scale: $0–$177,499.
| Full recipient address | Fees (USD) | Documented connection |
|---|---|---|
thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4 | $177,499 | Shared recipients of the main fundsEvidenceThe XRP senders of these swaps are connected by transfers to Bitget's compromised XRP address. Some swaps sent their main BTC proceeds to the same recipients used by another reviewed affiliate route. Reviewed 2026-09-30 |
thor1rj9f7m7n72nwslau7jzla09u0l4zr4ru8277d2 | $56,514 | Shared recipients of the main fundsEvidenceOne swap sender is connected by transfers to Bitget's compromised EVM address. All four main BTC recipients match recipients used by another reviewed affiliate route. Reviewed 2026-09-30 |
thor199tl2t4fkxqn7pawk8dgera79dl70rnczu6jsl | $18,080 | Fee proceeds returned to a swap senderEvidenceThis address exchanged its fee RUNE and directed the proceeds to a wallet that had itself used this affiliate. That wallet later received ETH from Bitget's compromised EVM cluster. Reviewed 2026-09-30 |
thor1c9wvfltxuj43622x8nc2ljf3qn7q9udc7dp79x | $4,544 | Shared recipients of the main fundsEvidenceSwaps paying this affiliate sent their main BTC proceeds to two recipients also used by two other reviewed affiliate routes. Reviewed 2026-10-01 |
thor1kufulp8x9r4r22ntl20rfhsj2wddujynyzxwxs | $2,885 | Shared recipients of the main fundsEvidenceSwaps paying this affiliate share both an ETH sender and a main BTC recipient with swaps paying thor19ya…wkcwz. The ETH sender is connected by consecutive transfers to the original stolen-ETH address. Reviewed 2026-10-01 |
thor19ya3vcnzfdu4f9s5t3rjn75dzqf936djewkcwz | $196 | Fee proceeds returned to a swap senderEvidenceThis address signed a swap of its fee RUNE and directed the ETH proceeds back to 0x5c768…eaea0, the sender of the swaps that generated its fees. An internal transfer confirms the payout. That sender is connected by consecutive transfers to the original stolen-ETH address. Reviewed 2026-10-01 |
thor1g5ajjv2lt5dhepfnj5amy7yd3dppc92mcazeel | <$1 | Transfer to another reviewed fee recipientEvidenceThis address signed a direct RUNE transfer to the reviewed affiliate recipient thor199tl…u6jsl. This later transfer establishes a connection and is not added to the fee total. Reviewed 2026-10-01 |
A closer look at thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4 shows where some of its fees went. It exchanged part of those fees, paid in RUNE, for USDT. Those proceeds passed through two Ethereum wallets before reaching an address labeled OKX Hot Wallet 5 by Etherscan. OKX could check its internal deposit records to investigate whether these transfers are linked to a customer account and who holds it.
Fee Recipients With No Additional Links Established Yet
Fees from the laundering swaps also went to the recipients below. Their addresses or registered THORChain names appeared in the signed instructions as fee recipients. Further links to the hackers’ wallets through fund transfers have not yet been established in the history reviewed so far.
A name such as naswap is a registered label used to route fees to a recipient. The THORChain holding-account row combines fees credited to several names.
THORChain Fee Recipients With No Additional Links Established Yet
Named in swaps laundering Bitget’s stolen funds
Data through
All address tables use the same linear fee scale: $0–$177,499.
| Full recipient address | Fees (USD) |
|---|---|
thor148sahwr5pg44cy0n23zwc723ugy2fptw0m8sauName used in swaps: naswap | $102,344 |
thor1dl7un46w7l7f3ewrnrm6nq58nerjtp0dradjtdTHORChain holding accountNames used in swaps: w1, t, vi, -_, ss, dx, ej, symbiosis | $92,438 |
thor1epz4l9jat4uqrag5j9d5aqrawrn0uhvdfxyxecName used in swaps: tch | $7,245 |
thor1dz5le8q2gytyn5gkfgcma4wueat4y655meyvnxName used in swaps: ns | $2,994 |
thor1ul3wekxelwcyuc4d85eza5s0qkhxqa2y9n7dar | $1,176 |
No matching recipients.
$0 in affiliate allocations has no known split between recipient addresses
The holding account shows combined credits for the listed names; their final payouts have not yet been traced here.
Method and sources
Figures cover the tracked transaction sample, use historical USD prices and are updated manually. Dates are UTC; displayed amounts are rounded to dollars. CSV and JSON retain cents.
- THORChain: liquidity and affiliate fees recorded in Midgard swaps.
- MetaMask: fee transfers to the identified recipient on Ethereum.
- Chainflip: broker fees on matched swap requests.
- CoW EthFlow: executed protocol and partner fees on settled trades.
Separate BSC fees are outside this calculation. Individual shares of THORChain liquidity and CoW fees have not been calculated. Holding-account amounts are credits; final payouts have not been traced.
These figures measure recorded fees in the tracked sample, not net profits or a complete accounting of every stolen-fund route. The article preparation date, the data cutoff and the dates of evidence reviews describe different events.
Receiving an affiliate fee does not establish common ownership. Reviewed connections, supporting transactions and review dates appear under “Evidence”.