THORChain liquidity providers took three-quarters of the fees from laundering Bitget's stolen funds

Bitget put the theft at roughly $387.5 million ^[2], and $761,725 in fees is about 0.2% of that, or roughly 20 basis points ^[16]. That rate is a floor. Sergeenkov's count stops at Oct. 2 at 10:22 UTC ^[5] and the divisor is the whole theft. Any stolen money not yet swapped by then pushes the true rate per dollar moved higher.

THORChain liquidity providers took 75.3% of the total ^[17]. The four published lines add up to $761,726, a dollar off the headline figure from rounding ^[18], so the affiliate fees Sergeenkov examined sit outside it. Those came to $465,914 across linked and unlinked recipients ^[19]. Counting both, moving the money through these services cost about $1.23 million, or 0.32% of the theft ^[22].

A THORChain affiliate fee goes to whichever recipient the swap instruction names ^[8]. A front end or script can fill in that field before the sender signs, so Sergeenkov said the field cannot on its own show who controls an address ^[9]. He sorted recipients by what their money did next. The seven with follow-on links to the laundering wallets took 55.7% of the affiliate money ^[20]. One of them, the $177,499 address, accounts for 68.3% of that linked share ^[21].

There are three readings of the linked $259,718 ^[6]. In the first, the seven addresses belong to whoever sent the swaps, and the launderer paid fees to itself, so part of the stolen principal comes back out labeled as referral income. In the second, an interface or laundering service named itself as affiliate and earned on the volume. Coincidence, the third, would mostly shrink the total. I think the first is likeliest, because the fee money and the principal keep meeting the same wallets: one recipient of $18,080 returned part of its proceeds to a wallet that had submitted a swap ^[14], and swaps naming different affiliates delivered principal to the same Bitcoin destination wallets ^[15]. The second reading is the counter-case, and Sergeenkov's own caveat about front ends allows for it ^[9].

Part of the $177,499 was swapped from RUNE to USDT, moved through two Ethereum wallets and reached an address Etherscan labels "OKX Hot Wallet 5" ^[11]. According to Sergeenkov, the exchange's own deposit records could show whether those transfers tie back to a customer account, and whose account it is ^[12]. His work does not establish who owns that account or whether the customer was involved in the theft ^[13].

The case against the infrastructure itself rests on revenue. THORChain hosted both the liquidity that earned three of every four fee dollars ^[17] and the affiliate field that routed the linked payments ^[8]. If OKX's records show a referral business or an unrelated customer at the end of the $177,499 path, the first reading fails, and what remains established is that the protocols were paid $761,725 to process stolen money ^[1].