REKTCOON PART 1 of 4Part 2 → Data as of 28 Sep 2026 · 13:43 UTC
Part 1 · The Ethereum leg

Following the Bitget money

In the first 30 hours of laundering, the attacker moved $60.5M through 246 fresh wallets and turned $20.9M of it into Bitcoin. This is where the trail starts.

by @REKTCOON · on-chain only · every claim links to a tx
Read in order. Figures here are as of 28 Sep 13:43 UTC. Since then Bitget raised the loss to $387.5M, ZachXBT published his own findings, and all ETH storage wallets have been drained. Part 2 and Part 3 continue the trail.
$60.5M
Laundered in 30h (22,442 ETH)
246
Fresh laundering wallets
$20.9M
Swapped to BTC · 15 addresses
21 min
To swap $47.6M of stablecoins
01The first move

Why nobody froze the stablecoins

Tether and Circle can freeze USDT and USDC, but only while the attacker holds them. On Ethereum, the attacker held them for about 21 minutes. The swaps ran through 0x7c96…3E1C, a wallet upgraded with EIP-7702 (MetaMask's StatelessDeleGator) that batched approvals and swaps.

In
34.75M USDT
12.85M USDC
3,000 XAUT
→
Out
22,327 ETH
UniswapX · 19,552 ETH
Uniswap v3/v4 · 2,776 ETH
45 fills · 19:08:59 → 19:29:35 UTC

UniswapX orders were filled by third-party market makers, who almost certainly didn't know the source. They are not accused of anything. USDT inflow tx ↗

02The pipeline

Round lots, then a spray

The ETH was split into round-number storage wallets (10,000 / 10,000 / 9,000…) and left alone for 2.5 days. On 27 Sep at 07:40 UTC, Exploiter 5 started draining into fresh wallets in 11–405 ETH pieces. Exploiter 4 followed through the same intermediate wallets (0xf7bC…96C3, 0x4a77…d330): one operator, one pipeline. We traced 246 fresh wallets, none of them labeled on Etherscan at the time.

Gross flows into each exit from attacker wallets, 27–28 Sep, USD at ETH $2,697. Skip:Go's contracts (CCTPRelayer, SkipGoSwapRouter, GoFastHandler) were identified from verified source code.

03The money shot

The first 15 Bitcoin addresses

Every THORChain deposit carries a memo that says where the swapped coins go. Decoding the attacker's 288 ETH-side deposits showed 7,761 ETH (≈ $20.9M) swapped into BTC and sent here. Part 2 found 111 more on the XRP side, 6 of them shared with this list.

#Bitcoin addressETH inSwaps
04Side note

The hacker is being hacked

Address-poisoning bots found the attacker's wallets within minutes. After every real transfer they send fake tokens with Unicode look-alike names from addresses that share the first and last characters of the real destination.

E឴឴ꓔHÚ5឴឴DCU5឴឴DꓔETH-"ETH" ×9 contracts
real  0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899
fake  0xD2c2C5D3C584692E0999c9D4b9D2eeF36006F899
05Index

All 246 ETH laundering wallets

06Method

How, and what we don't claim

Method
  • Starting points: Etherscan-labeled "Bitget Exploiter" wallets.
  • Followed ETH and major tokens (>1,000 holders) from 27 Sep 07:00 UTC.
  • Kept only wallets first seen after the hack; excluded THORChain vaults, busy services and anything with pre-hack history.
  • Filtered out address-poisoning fakes.
  • BTC destinations decoded from THORChain memos.
Not claimed
  • Attribution. That's Bitget's and TRM's; see Part 3 for the shared infrastructure.
  • That any market maker, bridge or service acted knowingly.
  • Final numbers. Funds were moving at publication.
07Evidence

Download the raw data

eth_laundering_flow.csv1,297 transfers with hashes eth_thorchain_to_btc.csv288 THORChain deposits with memos btc_addresses.txt15 BTC destinations eth_hacker_wallets.txt246 fresh wallets