THORChain refuses to block Bitget hack funds, citing decentralization
THORChain rejects Bitget's request to freeze stolen funds
THORChain, a decentralized finance (DeFi) protocol that lets people swap crypto across blockchains, has refused a formal request to block addresses linked to the recent hack of Bitget, a centralized crypto exchange that lost over $380 million on a Thursday night.
The refusal came just four months after THORChain itself halted trading following a roughly $10 million hack in May.
Key numbers
- Bitget lost more than $380 million in Thursday's hack.
- THORChain was hacked for about $10 million in May.
- THORChain processed $678 million in the two days after the Bitget hack, versus $20 million to $60 million daily volume in the prior week.
- That activity brought THORChain nearly $1.2 million in gross system income over two days.
What THORChain said
THORChain said on social media that it was "devastated to hear" of Bitget's hack, but stressed that the protocol is "decentralized and permissionless." It compared itself to Bitcoin, Ethereum, and BNB Chain, asking whether those networks should be expected to halt when stolen funds pass through them.
After facing criticism, THORChain said its earlier halt was meant to protect the protocol itself, that it never selectively blacklisted its own hacker, and that it "doesn't censor by design."
Bitget's appeal and the North Korea link
Bitget CEO Gracy Chen publicly asked THORChain to refuse service to the attacker addresses, saying the addresses are publicly listed and actively tracked. She argued that decentralization is a design principle, "not a shield for facilitating known stolen funds."
Blockchain security firm SlowMist, which is helping Bitget trace the stolen funds, also urged THORChain to act, saying decentralization should not become a blanket excuse when handling known stolen funds.
Chen described the hack as "highly consistent with known patterns of North Korean hacker organizations." This followed on-chain analysts spotting links between the attack and wallets used in earlier hacks attributed to North Korea. This attribution is a claim, not a confirmed finding.
What is confirmed
It is confirmed that THORChain turned down the requests from Bitget and SlowMist. It is confirmed that Bitget was hacked for over $380 million, that THORChain suffered its own roughly $10 million hack in May, and that THORChain's trading volume and income jumped sharply after the Bitget hack, according to its own analytics page.
Protos noted that after a $600 million hack on BNB Chain in 2022, BNB Chain validators did halt the chain, stopping the attacker from moving out most of the stolen funds.
What remains unclear
The identity of the Bitget hackers is not confirmed. The North Korea connection is based on statements from Bitget's CEO and on-chain analysts, not on an official finding.
Why it matters
The dispute highlights a longstanding tension in crypto: decentralized protocols cannot easily block specific users, even when stolen funds flow through them. According to Protos, THORChain has been used before to move stolen funds, including the majority of the $1.5 billion taken from ByBit in February last year, an incident also linked to North Korean hackers. Volume also spiked after April's $280 million Kelp DAO hack. A former THORChain developer known as "Pluto" left the project after the ByBit theft.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.