On-chain monitoring indicates that the wallet linked to the AFX Trade exploit swapped 655.4 ETH for 18.86 BTC through THORChain, moving stolen funds from Ethereum into Bitcoin in a single cross-chain conversion.
AFX Trade Hacker Converts 655.4 ETH Into 18.86 BTC
The reported movement shifted value out of Ethereum exposure and into Bitcoin exposure, a pattern flagged by security monitoring accounts including Blockaid. The swap route named in the tracking is THORChain, a protocol built for native cross-chain asset swaps.
AFX Trade Hacker — THORChain Swap
655.4 ETH → 18.86 BTC
Cross-chain conversion routed through THORChain to obscure stolen funds
The swap follows the exploit of AFX Trade, an Arbitrum-based protocol that was drained of roughly $24 million after bridge keys were compromised. The conversion observed on-chain represents a portion of those stolen funds being repositioned, not final proof of any laundering outcome.
AFX Trade acknowledged the incident through its official channel on X, and the exploit has been documented in independent reporting on the Arbitrum protocol breach.
Why THORChain Matters in This Cross-Chain Swap
THORChain enables direct swaps between native assets across separate blockchains, so an operator can move from ETH to BTC without holding a wrapped token or routing through a centralized exchange. That mechanic changes both the chain a wallet sits on and the monitoring context investigators must follow.
A conversion into native Bitcoin draws attention from on-chain analysts because it breaks a single-network tracking narrative. Following the funds now requires watching Bitcoin clusters rather than Ethereum addresses, a shift that complicates simple end-to-end tracing.
What the Swap Suggests About Tracing and Recovery Risk
Moving value across chains can add hurdles for investigators and the security teams working to recover breached funds. The observed conversion into Bitcoin may redraw the set of wallet clusters that analysts monitor next.
That said, the swap is a single data point rather than confirmation of a completed cash-out. Investigators typically track follow-on transactions after a swap of this kind, and cross-chain movement does not on its own make funds unrecoverable.
Security Lessons for Protocols and Users
High-profile exploit fund flows are routinely tracked in public by security researchers, which is how the AFX Trade movement surfaced in the first place. Wallet screening and rapid incident response remain central for platforms after a breach, since compromised funds can pass through cross-chain liquidity venues within hours.
The pattern echoes other recent DeFi incidents where fund movement was closely watched, including the Across Protocol relayer attack that produced under $4 million in net losses. For readers following exploit-related flows, transparent blockchains make near real-time community tracking possible even when attribution stays uncertain.
Broader market context adds to the stakes for exchanges monitoring suspicious wallets, with stablecoin inflows to exchanges sitting at 2025 lows and Ethereum spot ETFs recording renewed outflows.
FAQ About the AFX Trade Hacker’s THORChain Swap
How much ETH did the AFX Trade hacker swap?
On-chain tracking indicates the wallet swapped the reported ETH balance in one cross-chain conversion routed through THORChain.
How much BTC was received through THORChain?
The conversion yielded 18.86 BTC, moving the stolen value from Ethereum into native Bitcoin.
Why would a hacker move funds from ETH to BTC?
Converting across chains changes the monitoring context and shifts the assets an operator holds, which can complicate straightforward single-network tracing. The specific motive here is not confirmed.
Can the swapped BTC still be traced on-chain?
Bitcoin transactions remain publicly visible, so analysts can continue watching the destination addresses, though cross-chain movement adds hurdles to recovery efforts.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
