An address tied to the AFX Trade breach swapped 655.4 ETH for 18.86 BTC via THORChain, signaling a shift from Ethereum to Bitcoin after a major exploit. This cross-chain move moves stolen funds outside of Ethereum’s network, complicating tracing efforts.
Details of the Cross-Chain Transfer
The swap was executed on THORChain, a decentralized protocol allowing native asset exchanges across different blockchains without wrapped tokens or centralized exchanges. By converting Ethereum directly into Bitcoin, the hacker effectively moved funds onto a new blockchain, making it harder for analysts to track the flow.
According to on-chain data reviewed by Coincu Research and flagged by security accounts like Blockaid, the transaction is part of the aftermath of the AFX Trade hack on Arbitrum. Roughly $24 million was stolen when bridge keys were compromised, and this swap represents a portion of those funds being repositioned rather than a final laundering step.
Implications for Tracking and Recovery
THORChain’s ability to facilitate native cross-chain swaps means investigators must monitor Bitcoin clusters instead of Ethereum addresses once funds move. This adds complexity to tracking stolen assets and raises the challenge of recovery. The hacker’s strategy to use THORChain shows how cross-chain protocols can be exploited to obscure illicit transfers.
AFX Trade has publicly acknowledged the breach through its official X channel, with independent reports documenting the incident on the Arbitrum network. This case highlights the evolving risks as hackers use multi-chain tools to evade detection.
This content is for informational purposes and does not constitute financial advice.
