Bitget Hackers Swap ETH for BTC via THORChain
THORChain (RUNE)
Editor:
Eugene Serbin
ambcrypto.com reports that Bitget hackers are swapping Ethereum for Bitcoin through THORChain following a $351.6 million drain on 24 September. Pseudonymous investigator ZachXBT noted that funds are being chain-hopped via bridges and moved toward mixing services like Wasabi. Chinese-speaking illicit actors are reportedly assisting in moving the funds through public Discord and Telegram channels.
Gracy Chen previously linked the attack to a North Korean group based on matching IP and VPN patterns. Bitget’s Chen stated in a 28 September livestream that attackers used high-level internal credentials to bypass risk controls. The exec described this as a sophisticated targeted attack where no private key was compromised.
Bitget’s CEO urged THORChain to block identified attacker addresses, but the protocol rejected the proposal. THORChain argued its permissionless design prevents selective censorship of transactions. Bitget has fixed the attack path and resumed BTC withdrawals while Mandiant and SlowMist assist with tracing. User funds remain protected by a $464 million User Protection Fund covering the estimated losses.
How the market reacted
Whalio's own Binance spot order flow for RUNE, measured when this story was written up on 29 September 2026. Not the outlet's figures.
Rune is trading at $0.7740 with a 24-hour buy ratio of 52.6%, indicating that buyers are slightly outpacing sellers over the full day. However, the 1-hour buy ratio of 50.9% and the 4-hour ratio of 46.5% show that buying pressure is fading in the short term. The 24-hour volume delta is positive at $636,931, meaning more money is flowing into spot markets than out over the day. In contrast, the 4-hour volume delta is negative at -$155,418, suggesting that recent selling pressure has outweighed buying. The cumulative volume delta (CVD) closed at -$140,891, confirming that net selling pressure has dominated the immediate closing period despite the daily average favoring buyers.
The latest daily buy ratio of 45.1% sits at the 6th percentile of the last 323 days, against a median of 50.3% - among the weakest buying days it has had.
Was that an ordinary day?
The same Binance spot measurements for RUNE, averaged over the days leading up to the story.
This trading activity follows a week where the buy ratio averaged 52.3%, making today’s 24-hour ratio of 52.6% nearly identical to the weekly trend. Spot volume for the day was $12,480,166, which is 1.10 times the weekly average, indicating slightly elevated but normal trading activity. Over the preceding eight days, the coin saw a price increase of 18.3% and a total volume delta of $7,416,070. There were six days of net buying out of seven in the past week, showing consistent accumulation. Today’s volume is not unusual compared to the weekly baseline, as it sits just 10% above the average daily volume.