On-chain data indicates that the attackers behind the AFX Trade exploit converted 12,467 ETH into Bitcoin, shifting the stolen funds across assets as investigators track the AFX Trade hackers’ wallet trail.
The conversion was flagged by blockchain tracking account Lookonchain, which monitors attacker-linked wallets and cross-asset movement, in an on-chain report. The figure ties the movement directly to the AFX Trade case rather than to generic market flows.
AFX Trade, an Arbitrum-based platform, was drained of roughly $24 million after its bridge keys were compromised, according to reporting on the breach. That compromise is the origin point for the funds now being routed into Bitcoin.
What the On-Chain Data Shows
The primary evidence for the story is the transfer activity from attacker-linked wallets, not statements from the platform. Wallet behavior consistent with a single operator underpins the tracing.
The attacker address remains viewable on-chain, and its transaction history can be examined directly on the block explorer. That record is what allows the ETH-to-BTC conversion to be attributed to the same entity.
How the ETH Was Moved Into BTC
The conversion follows an earlier tranche in the same case, in which an AFX Trade hacker swapped 655.4 ETH for 18.86 BTC via THORChain. That pattern points to cross-chain swap routing rather than a single centralized exchange.
Moving Ether into Bitcoin through a decentralized cross-chain route lets an operator change asset exposure without passing through a custodial checkpoint. In hack reporting, a shift into BTC matters because it typically signals an attempt to consolidate and hold value outside the compromised chain.
Why the Move Matters for Tracing
Cross-asset conversion complicates recovery because funds no longer sit on the network where the breach occurred. Investigators following the trail must now watch Bitcoin destinations rather than only Ethereum or Arbitrum addresses.
After a move like this, analysts generally track whether the converted BTC is consolidated, split across fresh wallets, or sent toward mixing services. Each pattern changes how realistic recovery becomes for affected AFX Trade users.
What to Watch Next
The most material follow-up signal would be further movement of the converted Bitcoin, especially into new destination wallets or deposit addresses. Splitting behavior would suggest an operator preparing to obscure the trail.
Dormancy, by contrast, would indicate the funds are being held. Confirmation from AFX Trade or independent blockchain analysts would help validate any next-stage developments beyond the current wallet evidence.
FAQ
What happened in the AFX Trade case? The Arbitrum-based AFX Trade platform was drained of about $24 million after its bridge keys were compromised, and attacker-linked wallets have since moved funds across assets.
How much ETH was converted? On-chain tracking indicates the attackers converted 12,467 ETH into Bitcoin.
Does converting ETH to BTC make recovery harder? It can. Moving value onto a different chain forces investigators to follow Bitcoin destinations, and cross-asset routing removes the funds from the network where the breach originated.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
