What happens when stolen coins leave one chain and land on another before anyone can tap the brakes? That is the question hanging over a fresh set of swaps that turned a large pile of ETH into Bitcoin after an exchange asked a cross-chain network to block the wallets it had already named. I have watched these post-breach stories long enough to know the pattern. First comes the shock. Then comes the tracing. Then comes the awkward moment when a protocol says it can halt the whole machine but not one address.
How The Latest Swaps Changed The Trail
On Monday morning, a wallet already flagged as part of the attacker’s activity pushed through a run of swaps. The batch work was not subtle. Most tickets sat near 100 ETH. The completed set moved about 2,390 ETH into 75.2 BTC, a haul valued near $6.3 million at the prices used in the review. Four more tickets covering about 400 ETH were still sitting open when those records were checked.
All of the finished Bitcoin landed in a single receiving address. That detail matters. Scatter is harder to follow. One destination is easier to watch, at least until the next hop. Two of the 100 ETH orders only filled in part because the price floor on those tickets was not met. Roughly 114 ETH bounced back to the sender. In my experience, leftover coins like that are easy to miss in a headline and still useful on-chain.
Why The Exchange Asked For A Block
The exchange had already published attacker addresses across several networks and asked the swap network over the weekend to refuse service to those wallets. The argument from the exchange side was blunt. Decentralization, in that view, is a design choice. It should not become cover for moving funds that investigators have already tied to a breach.
Decentralization is a design principle, not a shield for facilitating known stolen funds.
That line is easy to repeat and hard to enforce. A cross-chain swap service is built so users can change assets without parking them at a centralized venue. ETH goes in on one side. Bitcoin comes out on the other. Both legs stay visible on public ledgers. Investigators can still follow the map. They just cannot treat the map like a bank branch with a manager who can lock a drawer.
What The Network Says It Can And Cannot Do
The protocol team rejected an address-specific freeze. Emergency tools, they said, exist to protect the network itself. A halt can stop swaps across the system or pinch activity on a connected chain. Either move would also stall honest users. That is the trade-off they put on the table, and it is not a small one.
A security firm pushed back. It pointed to validator votes, signing controls, and chain-level pauses described in the protocol’s own docs. Those levers, the firm argued, give node operators more room than a simple “we cannot touch one wallet” story suggests. The protocol still frames the emergency halt as a shield for the network, not a blocklist for named addresses. I tend to think both sides are talking about real tools. They are just talking about different jobs for those tools.
There is recent history here. After an attacker drained about $10.7 million from a vault in May, operators stopped activity while developers patched the hole. Trading came back in June after roughly five weeks. The May attacker’s addresses were not individually blacklisted. That episode is now the reference point every time someone asks for a surgical freeze.
The Breach Numbers Keep Moving
The first public estimate put assets transferred to attacker-controlled addresses near $351.6 million. After a fuller review that included Zcash and TRON holdings left out of the first pass, the figure rose to about $387.5 million. The exchange said the jump came from better accounting of the original incident, not a second wave of theft.
Unauthorized transfers were spotted at 18:31 UTC on September 24. Withdrawals were paused. Cold wallets were described as still intact. Investigators later said the hole had been found and fixed. Outside firms were brought in for the forensic work and the security review. A full public story of how the attacker got in has not been released. That silence is common. It is also frustrating if you are trying to judge whether the same door could open again.
| Item | Reported figure | Why it matters |
| Initial loss estimate | About $351.6 million | First public scale of the incident |
| Revised transfer total | About $387.5 million | Includes assets missed in the first count |
| ETH converted in completed swaps | About 2,390 ETH | Core of the Monday conversion |
| Bitcoin received | 75.2 BTC | Single destination address |
| Pending ETH at review time | About 400 ETH | Trail was still live |
| Returned unfilled ETH | About 114 ETH | Partial fills at the set price floor |
A Separate Path Already Used Privacy Mixing
The Monday swaps were not the first attempt to change the texture of the funds. A day earlier, a compliance team traced about four BTC into a CoinJoin round after coins had moved from TRON to Ethereum and then through the same swap network. CoinJoin bundles many inputs and outputs in one transaction. Matching a specific coin to a specific person gets harder. Not impossible. Harder.
That earlier hop is a reminder. Cross-chain movement is only one layer. Privacy tools are another. Public ledgers still record the edges of those tools. The middle of the bundle is where the picture blurs. If you work in recovery, you hate that blur. If you built the tool for ordinary users who want less surveillance, you call it the point.
Bounties, Freezes, And Who Gets Paid
After the first shock, the exchange launched a recovery bounty. Separate 5% rewards were offered for eligible work that freezes stolen assets and for work that recovers them. Primary attacker addresses were published across Ethereum-compatible networks, the XRP Ledger, Zcash, and TRON. A tracing dashboard was posted so outsiders could watch new hops.
Eligibility sits with the exchange. Work done under a court order or a law-enforcement request does not qualify. That rule is practical. It also tells you how this industry still splits the difference between public hunters and official channels.
Stablecoin issuers did act on identified balances. One issuer froze 99,990 USDC tied to the attack. Another froze 218,023 USDT. Those freezes hit tokens that live under issuer control. They do not answer the separate request to stop ETH-to-BTC swaps. Different rails. Different power.
- Published attacker addresses across several chains
- A tracing board for later movements
- A 5% freeze reward and a 5% recovery reward
- Stablecoin freezes on identified USDC and USDT balances
- No address-level block on the swap network
Withdrawals Are Coming Back In Stages
Customers do not live in the tracing room. They want their coins. The exchange laid out a staged return of withdrawals after security checks. Bitcoin on the Bitcoin network was slated to reopen at 08:00 UTC on September 28. ETH across Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism was set for the same hour on September 29.
USDT on Ethereum, BNB Smart Chain, Solana, and TRON was booked for 08:00 UTC on September 30. Other tokens, fiat rails, and peer-to-peer activity were pushed to a last stage on October 2. Users were told to wait for official confirmation before assuming a window was live. That last sentence is the one people skip, then regret.
I have found that staged reopenings look tidy on a calendar and messy in practice. Queues form. Support tickets pile up. A single delayed chain becomes a rumor mill. The timetable is still useful. It is a promise with timestamps, not a guarantee that every ticket clears on the first try.
The Deeper Fight Over Cross-Chain Power
Strip away the dollar figures and you are left with a governance argument. Can a swap network treat one wallet as radioactive without becoming a compliance desk? If yes, who holds the list? If no, what happens when stolen funds keep walking through the front door in public?
Perhaps the most interesting aspect is how ordinary the mechanics look. The orders were not exotic. They were sized, timed, and priced. Some missed the floor and bounced. The network did what it is built to do. That is why the refusal stings for the exchange and why it reads as consistency to the protocol team.
Node operators can vote. They can pause a connected chain. They can halt the whole market in an emergency. Those are blunt instruments. A blocklist is a scalpel. Protocols that market themselves as credibly neutral are allergic to scalpels, because a scalpel implies a surgeon, and a surgeon implies a policy.
A network halt can protect the protocol. It is not a selective freeze of one swap.
That sentence will be quoted again the next time a large venue gets hit. Count on it. The next victim will make the same call. The next protocol will give a version of the same answer. Markets will keep building bridges anyway, because users want to move value without asking a custodian for permission.
What Investigators Can Still See
Visibility did not vanish when the asset changed chains. ETH entry and BTC exit both sit on public records. The receiving Bitcoin address is known. Partial fills and refunds are known. Pending tickets were known at the time of review. That is a lot of surface area.
What fades is intent at the next hop. Will the 75.2 BTC sit? Will it split? Will another mixer round appear? Will some portion hit an over-the-counter desk that still asks questions? Those are the live variables. Tracing firms will watch the address. Bounty hunters will watch the address. The attacker, if this wallet is still under the same control, already knows the address is hot.
Hot coins have a shorter list of friendly doors. That is the quiet pressure in every recovery story. You do not need a freeze on a swap network if the next venue refuses the deposit. You do need coordination, and coordination is slow.
Lessons For Anyone Holding Coins On An Exchange
None of this is abstract if your withdrawal button went gray last week. A few habits still reduce the blast radius when a venue gets hit. They are not glamorous. They work more often than slogans do.
- Keep long-term holdings in wallets you control, not in a trading account.
- Treat hot balances as inventory, not savings.
- Watch official channels for reopen windows instead of rumor threads.
- Record your own deposit addresses and tx ids before you need them.
- Assume cross-chain hops will be used after a theft, and plan your own security as if that is normal.
I know that list sounds like a lecture. Fair. The people who needed it most last week were the ones who thought “it will not be my venue.” It was somebody’s venue. Next month it will be another name. The pattern is older than this incident.
Why Bitcoin Remains The Preferred Exit
There is a reason the Monday flow ended in BTC. Liquidity is deep. The asset is widely accepted. Once coins sit on the Bitcoin network, the set of follow-on tools changes. Mixers, swaps, and quiet desks all speak that language. ETH was the starting inventory in this batch. Bitcoin was the destination of choice.
That does not make Bitcoin the villain. It makes Bitcoin the reserve asset of last resort in a messy market. Stolen dollars used to chase the same logic in older systems. New rails, old instinct. Convert into the thing that travels.
For analysts, the conversion is a bookmark. You mark the ETH wallet. You mark the BTC address. You wait for the next signature. Patience is underrated in this work. Drama is overrated.
The Policy Shadow Over Neutral Bridges
Regulators will read this episode as a case study whether the protocol wants that or not. A large venue asked for help. A decentralized network said help of that shape would break the product. Stablecoin issuers, by contrast, froze named balances. The split is now on the record.
In my view, that split will drive the next round of rule-making more than any white paper. Lawmakers understand issuer freezes. They struggle with validator votes and emergency halts. When they struggle, they reach for analogies from banking. Those analogies fit poorly and still get used.
None of that settles the technical question. It does raise the cost of staying credibly neutral. Every refused freeze becomes a slide in someone else’s presentation. Every successful mixer hop becomes another slide. The industry can dislike that theater and still have to sit through it.
What To Watch Next
Three threads are live. First, the receiving Bitcoin address. Second, the pending 400 ETH if those tickets still exist by the time you read this. Third, the staged withdrawal calendar and whether each window actually opens on time.
A fourth thread sits in the background. Will any court try to compel a more targeted intervention than a full halt? That path is slow. It is also how these arguments leave Twitter and enter filings. I would not bet on speed. I would bet on more paper.
Until then, the coins that already moved are doing what stolen coins do. They look for thinner surveillance and thicker liquidity. The swap network did not invent that demand. It just happened to be open when the demand showed up with a filled wallet and a price limit.
If you take one thing from this mess, take the unromantic one. Public chains make the first miles of a theft visible. They do not make recovery automatic. Bridges make movement easy. They do not make responsibility clear. Those two facts can live in the same sentence. They usually do, right after the next exploit, when someone asks again why a freeze request came back as a no.
The $6.3 million conversion is not the end of the story. It is a chapter break. The address is known. The amounts are known. The refusal is on the record. What is not known is the next signature. That is the part worth watching, and it will not arrive with a press-friendly headline. It will arrive as another line on a block explorer, late, quiet, and easy to miss if you stopped looking after the first swap batch cleared.
