THORChain rejects Bitget request to block hacker wallets

THORChain has rejected Bitget chief executive Gracy Chen’s call to block addresses linked to the cryptocurrency exchange’s $387.5 million security breach, arguing that its permissionless network cannot selectively censor transactions.

The dispute emerged after assets stolen from Bitget were routed through cross-chain services, including THORChain, and converted into Bitcoin. Chen publicly urged the protocol to refuse service to attacker-controlled addresses that had already been identified and flagged, saying decentralisation should not become a shield for handling known stolen funds.

THORChain responded that its network operates on permissionless principles comparable with base-layer blockchains such as Bitcoin and Ethereum, placing responsibility for transaction processing with protocol rules and independent node operators rather than a central intermediary. The response has intensified scrutiny of how decentralised finance infrastructure should deal with assets traced to thefts.

Bitget initially estimated that $351.6 million in assets had been affected by unauthorised transfers detected on September 24. The exchange subsequently raised the figure to about $387.5 million after expanding its accounting to additional assets and networks, saying the revision did not represent further unauthorised withdrawals.

Bitget said the breach affected parts of its hot and warm wallet infrastructure while cold wallets remained secure. The company said private keys were not compromised and that the vulnerability had been identified and remediated. It brought in cybersecurity specialists Mandiant and SlowMist to assist its investigation and tracing work.

Chen said attackers compromised a wallet backend and used spoofed transaction data rather than stealing private keys, consistent with Bitget’s statement that the incident was contained to exchange wallet layers.

The exchange suspended withdrawals while security checks were conducted and said no further unauthorised transfers were possible after remediation. Its self-custodial Bitget Wallet product was not affected because it runs on infrastructure independent of the exchange, according to the company.

Blockchain analysis has shown portions of the stolen BNB and TRX moving through intermediary wallets and cross-chain routes before reaching THORChain, where they were exchanged for Bitcoin. Bitquery calculated on September 25 that 126.71 bitcoin had been paid out across 66 swaps involving stolen BNB and TRX routes, worth about $10.6 million at the time, while much larger holdings of Ether and XRP remained stationary.

TRM Labs separately traced roughly $9.8 million in BNB from a Bitget hot wallet through several exploiter wallets before portions reached THORChain over about 13 hours and were converted into Bitcoin. The company has tagged addresses across several networks as connected to the Bitget exploiter.

Chen has said preliminary evidence indicates that a North Korea-linked hacking group was likely responsible, citing attack techniques and internet-protocol information examined during the investigation. Blockchain analytics company Elliptic also assessed the incident as highly likely to be linked to North Korea, while the attribution has not been established by a public finding from law-enforcement authorities.

The censorship dispute is complicated by THORChain’s own technical architecture. Although the protocol says it has no central operator capable of simply blacklisting an address, its published code and documentation provide mechanisms through which node operators can pause network activity during emergencies. Its Mimir governance system also includes controls capable of halting trading globally or on individual chains.

Those mechanisms are designed for network protection rather than routine address-level sanctions. THORChain documentation says node operators can trigger temporary pauses, while broader configuration changes can be adopted through consensus. That distinction has become central to the argument over whether technical capacity to halt activity creates an obligation to intervene against identified stolen assets.

Critics, including OKX founder Star Xu, have challenged THORChain’s comparison with Bitcoin, pointing to its ability to pause network functions. Supporters of the protocol’s position argue that introducing discretionary filtering would require participants to decide which external claims are legitimate, potentially changing the permissionless character of the system.