Cross-chain liquidity protocol THORChain has rejected demands to freeze wallet addresses linked to the $387.5 million exploit of cryptocurrency exchange Bitget on September 24, maintaining its permissionless architecture despite growing industry backlash.
Key Takeaways
- Bitget suffered a $387.5 million security breach on September 24, with attackers routing funds through THORChain to convert them into Bitcoin.
- Bitget CEO Gracy Chen requested protocol-level interventions, supported by a $464 million protection fund to compensate users and a 5% bounty for asset recovery.
- Industry critics, including OKX founder Star Xu, pointed to prior network halts—such as a $10 million vault pause in May and a January 2025 product freeze—to counter claims that THORChain cannot alter state.
- THORChain's native token RUNE surged over 20% in 24 hours following the protocol's refusal to intervene.
Bitget Appeals for Interventions as Hacker Launders Funds
Following the $387.5 million heist on September 24, public tracking revealed the attacker began swapping stolen tokens into Bitcoin via THORChain, an uncustodial protocol requiring no identity verification. Bitget CEO Gracy Chen publicly appealed to the network to block the flagged wallet addresses, arguing that "decentralization is a design principle, not a shield for facilitating known stolen funds."
Blockchain analytics firm MistTrack highlighted that this is not an isolated incident. Following the $1.46 billion Bybit exploit last year, nearly $1.2 billion in stolen assets was traced through THORChain. Researchers and Bybit confirmed that North Korea's Lazarus Group was likely responsible for a February 2025 attack, moving over $1 billion through the platform. Chen noted that North Korea is also the prime suspect behind the recent Bitget attack.
To safeguard its user base, Bitget confirmed that its $464 million user protection fund will cover all customer losses. User withdrawals are scheduled to resume on Monday at 8:00 UTC, starting with Bitcoin, while the exchange offers a 5% bounty to anyone assisting in freezing the funds.
Selective Governance Sparks Criticism From Competitors
In response to calls for asset freezes, THORChain stated that base-layer networks like Bitcoin, Ethereum, and BNB Chain do not censor transactions, questioning what responsibility core protocols should bear when handling illicit flows. However, industry leaders quickly rejected the comparison.
OKX founder Star Xu called the comparison "False!", highlighting that THORChain node operators have previously halted operations to protect internal assets. Internal reports show the network paused a vault following a $10 million drain in May. Furthermore, nodes quickly halted the network during a 2021 hack, and in January 2025, voted overnight to freeze its lending and savings products. "A network that can stop when its own funds are at risk, but refuses to do so when someone else's funds are at risk, is not 'like Bitcoin,'" Xu stated.
Despite the controversy, THORChain's native token RUNE rallied by over 20% within 24 hours following the exchange of statements.
Why It Matters
This dispute highlights the fundamental tension between permissionless cross-chain infrastructure and centralized compliance pressures. As global regulatory bodies issue stricter oversight on decentralized protocols and asset recovery—similar to broader moves in fresh regulatory guidance—protocols that fail to curb criminal activity risk facing targeted legal enforcement. Furthermore, while the rally in RUNE suggests that token holders favor protocol neutrality, THORChain's past record of emergency halts exposes vulnerabilities in its censorship-resistance narrative.
