Bitget Hack Generates Over $761K in Fees Across Crypto Protocols
An analysis by Andrey Sergeenkov revealed that funds stolen from the crypto exchange Bitget on September 24 generated over $761,000 in fees across various protocols and services. The largest share, $573,226, came from liquidity fees on THORChain, where the stolen funds were swapped. Additional affiliate fees totaled $465,914, though $92,438 remained as credits in a THORChain holding account with untraced final payouts.
The hack resulted in a loss of approximately $387.5 million for Bitget, with the stolen funds laundered through multiple platforms, including THORChain and NEAR Intents. THORChain declined to block the attacker addresses, citing its design, while NEAR Intents reported that attackers attempted to route over $50 million through its system, with only $166,000 successfully completing swaps.
Sergeenkov's ledger identified several entities that collected fees from the swaps, including MetaMask, Chainflip, and CoW EthFlow. However, the analysis noted that these fees do not imply any wrongdoing by the protocols or services involved. The study also highlighted that the fee income represents only a small fraction (about 0.2 percent) of Bitget's total loss.
The investigation further traced affiliate addresses linked to the stolen funds, with some fee proceeds leading to wallets associated with the hack. For instance, one THORChain address received $177,499 in fees, with some funds later swapped to USDT and transferred to an address labeled as an OKX hot wallet. Despite these findings, the ledger emphasized that receiving an affiliate fee does not establish common ownership or direct involvement in the hack.