THORChain has rejected requests from Bitget to freeze wallets tied to hackers who stole $387.5 million from the exchange on September 24, 2026, arguing that blocking addresses would betray the permissionless design at the core of its network. The refusal, made public on September 27, has drawn sharp public criticism from Bitget CEO Gracy Chen and OKX founder Star Xu, reopening a dispute that has followed the cross-chain protocol for years: what happens when the tools built for financial freedom become the preferred route for laundering stolen crypto.
A Familiar Route for Stolen Funds
THORChain is a decentralized protocol that lets users swap assets across different blockchains without relying on a centralized intermediary. That feature is precisely what makes it attractive to both legitimate traders and criminals: it allows stolen tokens to be converted into Bitcoin without passing through any single company that could be compelled to freeze the transaction. Bitget and OKX say this is exactly what happened after the September 24 hack, with stolen assets funneled through THORChain and converted into Bitcoin.
This is not an isolated episode. THORChain was central to laundering roughly $1.2 billion from last year’s $1.46 billion Bybit hack, an attack attributed to North Korea’s Lazarus Group, which moved over $1 billion through the network. The protocol has a documented history of pausing operations under pressure — it halted its own network after a 2021 hack, and its community voted in January 2025 to freeze lending and savings products after mounting losses. More recently, a roughly $10 million drain in May triggered another vault pause. Against that backdrop, THORChain’s decision to keep Bitget-linked wallets open despite direct requests stands out as a deliberate stance rather than an oversight.
What the Refusal Means for the Industry
The core tension here is not new, but the dollar figures keep growing. Centralized exchanges like Bitget and OKX operate under regulatory obligations and public accountability that push them toward freezing suspicious funds whenever possible. Decentralized protocols like THORChain answer to no single authority and have no central switch to flip on command — freezing a wallet would require consensus among node operators and would contradict the permissionless promise that draws users to the network in the first place. Gracy Chen and Star Xu have both argued that this stance falls short of the neutrality Bitcoin’s base layer maintains, suggesting THORChain is choosing convenience over genuine neutrality when it lets stolen funds pass through unimpeded.
The dispute also underscores how thoroughly the industry’s laundering problem has moved beyond simple mixers. Hackers increasingly route stolen assets through legitimate-looking DeFi infrastructure precisely because it offers plausible deniability and no compliance department to answer subpoenas. That reality has already played out elsewhere in the Bitget case: as detailed in reporting on the hacker moving $83 million in XRP that Ripple cannot freeze, attackers appear to be deliberately selecting assets and networks where no centralized party can intervene, turning the absence of a kill switch into a laundering strategy.
Bitget, for its part, has moved to contain the damage on its own side. The exchange has committed to covering customer losses through a $464 million protection fund and offered a 5% bounty for help freezing stolen assets — an incentive aimed at third parties, blockchain trackers like MistTrack, and possibly even the broader community, since THORChain itself has declined to act. Bitget also confirmed it will resume Bitcoin withdrawals on Monday at 8:00 UTC, a detail covered more fully in coverage of Bitget’s plan to resume withdrawals after absorbing the $387 million hack. Meanwhile, RUNE, THORChain’s native token, climbed more than 20% in 24 hours, a reminder that market reaction to these controversies is not always straightforwardly negative for the protocol involved.
What to Watch Next
Several threads from this episode deserve continued attention. First is whether THORChain’s governance community revisits its stance now that the exchange-side criticism has gone public and prominent figures like Chen and Xu are applying reputational pressure — the network has changed course before, including the 2021 shutdown and the January 2025 freeze of lending products. Second is whether Bitget’s bounty program or MistTrack’s tracing work yields any recovery of funds, given that on-chain tracking has become increasingly sophisticated even when protocols themselves decline to intervene.
Third, and more broadly, is how this incident feeds into the wider regulatory conversation around crypto. With US Senate deadlock pushing crypto rules into regulators’ hands, cases like this one — where a decentralized protocol openly refuses exchange requests to block hacker wallets — are likely to become reference points in debates over how, or whether, DeFi infrastructure can be held to the same standards as centralized platforms. Whether that pressure eventually forces changes to how permissionless networks operate, or instead hardens their resistance to intervention, remains one of the more consequential open questions in the industry.
Source: BeInCrypto
This content is for informational purposes only and does not constitute financial or investment advice.
Create a free account to comment and earn rewards.
Create account Log in