THORChain declines Bitget request to block stolen funds

Decentralized finance protocol THORChain has rejected a formal appeal to deny service to wallet addresses tied to the recent Bitget breach, in which the centralized exchange lost more than $380 million on Thursday night.

The rebuff comes four months after THORChain itself suspended trading following a $10 million exploit.

In the wake of Thursday's incident, Bitget CEO Gracy Chen described the hack as "highly consistent with known patterns of North Korean hacker organizations," after blockchain investigators flagged links to wallets associated with previously attributed attacks.

Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses. Decentralization is a design principle, not a shield for facilitating known stolen funds.
The industry is watching.

— Gracy Chen @Bitget (@GracyBitget) September 26, 2026

Read more: Bitget’s eighth birthday ends with a $352M hack

Both Chen and blockchain security firm SlowMist, which is helping Bitget trace the stolen assets, made appeals to THORChain. SlowMist urged that "decentralization should not become a blanket excuse when dealing with known stolen funds."

In response to those calls, THORChain said it was "devastated to hear" of the Bitget breach but reiterated that it operates as a decentralized and permissionless network.

The project drew a comparison to "Bitcoin, Ethereum, and BNB Chain," questioning whether those networks would be expected to halt transactions when stolen funds passed through them.

It is worth noting that after a $600 million exploit in 2022, BNB Chain validators did pause the chain, blocking the attacker from moving most of the stolen assets.

We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved.

THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain.

What responsibility should Bitcoin, Ethereum, and BNB Chain bear when…

— THORChain (@THORChain) September 26, 2026

Read more: Explained: How $600M was stolen from Binance’s BNB chain

The refusal is being viewed by many as inconsistent, given that THORChain's validators moved quickly to halt trading when the protocol was hacked for roughly $10 million in May.

Looking back at that incident, THORChain has said the halt was meant to protect the network, that it never selectively blacklisted the hacker, and that it "doesn't censor by design."

According to THORChain's own analytics page, the protocol processed $678 million in the two days following the Bitget hack, compared with daily volumes of $20 million to $60 million in the week before.

Over those same two days, it generated nearly $1.2 million in "gross system income."

THORChain’s track record

THORChain swaps have long been a preferred tool for hackers, most notably used to move the bulk of the $1.5 billion stolen from ByBit in February last year.

That theft was also attributed to North Korean hackers operating under the "TraderTraitor" label.

After that incident, a similar debate emerged, and a former THORChain developer known as "Pluto" left the project in protest.

Similarly, trading volume surged immediately after April's $280 million Kelp DAO hack, as noted by Specter, the investigator who linked the Bitget hack to North Korea, in their Telegram group.