According to on-chain monitoring firm Lookonchain, the hacker responsible for draining $351.6 million from Bitget is actively moving funds, swapping ETH into BTC via the cross-chain liquidity protocol THORChain.

Permissionless cross-chain routes remain the preferred bridge for shifting illicit assets. Once the funds cross over into native Bitcoin and scatter across fragmented paths, tracing and freezing them becomes an uphill battle.