The hackers behind Bitget's September breach paid more than $760,000 in fees while moving and swapping stolen crypto, according to new on-chain research.
- Independent blockchain researcher Andrey Sergeenkov traced the fees generated across the routes used to move Bitget's stolen funds and found about $761,725 went to protocols and services involved in the transactions.
Protocol & service fees collected from swaps of Bitget's stolen crypto. Source: Sergeenkov.com
- The total includes liquidity fees, affiliate fees and other charges collected through infrastructure, including THORChain, Chainflip, MetaMask and CoW EthFlow.
- The figures cover the transactions Sergeenkov was able to track through Oct. 2 and aren't meant to represent every route used by the attackers.
- To get the data, Sergeenkov traced a sample of transactions tied to the laundering routes and calculated fees using historical USD prices.
- THORChain figures came from liquidity and affiliate fees recorded in Midgard swaps, while MetaMask, Chainflip and CoW EthFlow fees were taken from on-chain transfers, matched swap requests and settled trades.
Some fee recipients had other links
The more unusual finding came from THORChain as its swaps can include an affiliate fee, where part of a trade is sent to an address named in the swap instructions.
Sergeenkov found that addresses receiving about $259,700 in those fees also had other financial links to wallets involved in moving Bitget's stolen funds.
In some cases, fee proceeds were sent back to a wallet that had submitted one of the swaps.
In others, swaps using different affiliate addresses sent the main stolen funds to the same Bitcoin destinations.
That doesn't necessarily prove the fee recipients were controlled by the hackers as Sergeenkov stressed that an interface or script can insert an affiliate address before a user signs a transaction.
- Another roughly $206,000 in affiliate fees went to recipients for which no additional links had yet been established.
Speaking with The Coinformer, Sergeenkov said the issue goes beyond the Bitget hack.
He argued that crypto infrastructure can make money from harmful activity even when it's not directly involved in the attack itself, pointing to MEV on Ethereum as another example.
Andrey Sergeenkov
One trail reached OKX
The largest linked THORChain affiliate address collected about $177,500 in fees, according to the research.
Part of those proceeds was later swapped from THORChain's RUNE token into Tether's USDT stablecoin and passed through two Ethereum wallets before reaching an address labeled by Etherscan as OKX Hot Wallet 5.
- The research measures fees generated from the tracked laundering routes, not the net profit earned by individual protocols or users.
Who should bear the cost
When asked about the broader implications, Sergeenkov said crypto's neutrality argument is often applied inconsistently when stolen funds move through decentralized infrastructure.
Andrey Sergeenkov
He pointed to Ethereum's 2016 fork after The DAO hack and THORChain's network halt after its own vault exploit in May 2026. The two interventions were technically different, he said, but raised a similar question over when coordinated action becomes acceptable.
Andrey Sergeenkov
Sergeenkov argued that the current incentives leave victims carrying the losses while infrastructure handling the stolen funds can still collect fees.
Andrey Sergeenkov
He also called for addresses that earned fees from laundering the stolen Bitget funds to be publicly labeled and linked to the underlying transactions so others can verify the connection.