Bitget Hack Laundering Generates Over $760,000 in Protocol Fees

The bulk of these fees accumulated through liquidity provider incentives and standard service charges. THORChain liquidity providers led the intake with $573,226, followed by MetaMask at $149,417, Chainflip at $26,751, and CoW EthFlow at $12,332. These figures reflect the high volume of activity as the stolen funds were rapidly moved across the ecosystem.

Beyond standard service fees, Sergeenkov focused on THORChain affiliate rewards, identifying $259,718 routed to specific recipient addresses that showed suspicious financial ties to wallets involved in the hack. One primary address received $177,499, with portions of that income eventually traced to an OKX hot wallet. While being named as an affiliate recipient does not definitively prove ownership by the attackers—as scripts can inject these addresses during transaction signing—the researcher noted that several recipients shared distinct financial links with the broader laundering operation.

An additional $206,196 in affiliate fees went to recipients for which no direct link to the hackers could be established. Sergeenkov’s analysis highlights the complexity of tracing illicit flows in decentralized environments, where automated systems and fee-sharing mechanisms can obscure the destination of stolen assets. The findings emerge amid a broader debate between Bitget and various protocols regarding the responsibility of platforms to intervene in transactions involving compromised addresses.