THORChain Rebuffs Bitget's Call to Block Hacker Funds

Thieves made off with $387.5 million from crypto platform Bitget on September 24. A portion of those funds is currently being converted into Bitcoin via THORChain, which rejects calls to halt the process.

THORChain facilitates cross-chain swaps without verifying users' identities. When funds become Bitcoin, they become impossible for any company to freeze.

Bitget Calls on THORChain to Reject Hacker Transactions

The hacker's wallets are publicly monitored. Gracy Chen, Bitget's CEO, urged THORChain to deny them service.

“Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching,” she said.

According to blockchain analyst MistTrack, such activity is not unprecedented. Following the Bybit hack last year, which involved $1.46 billion, approximately $1.2 billion was said to have been funneled through THORChain.

THORChain and Stolen Funds: The Industry Needs Answers

After the $1.46B @Bybit_Official hack last year, nearly $1.2B in stolen funds was reportedly traced through @THORChain as the attackers moved assets across chains.

Today, following another major security incident at @Bitget…

— MistTrack🕵️ (@MistTrack_io) September 25, 2026

THORChain Views Itself as No Different From Bitcoin

THORChain responded critically. It describes itself as permissionless and accessible to all, comparable to Bitcoin, Ethereum, and BNB Chain.

“What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?” the team stated.

This reply shifts the focus onto the accountability of those foundational blockchains when confronted with known stolen assets, sidestepping demands for THORChain to intervene or surveil suspicious transfers.

This situation underscores the fundamental conflict within cryptocurrency: the permissionless nature of THORChain's cross-chain swapping versus the industry's expectation that protocols should act on publicly visible hacker wallets.

THORChain Has Intervened in Past Incidents

Star Xu, who founded competing exchange OKX, labeled THORChain's Bitcoin analogy as false. This comes after an incident in May when THORChain halted a vault following a drain of about $10 million, as detailed in the company's report.

“A network that can stop when its own funds are at risk, but refuses to do so when someone else’s funds are at risk, is not “like Bitcoin,”” the OKX executive slammed.

This was not an isolated event. Network nodes swiftly stopped operations following a hack in 2021. In January 2025, they voted to freeze lending and savings products.

when thorchain got drained in 2021, the network halted within hours. when thorfi went underwater in jan 2025, nodes voted to freeze withdrawals overnight.
“decentralized and permissionless” seems to apply only when it's other people's money.
a sanctioned state already used you to… https://t.co/V3PXFB5PCG

— Matt (@matthubuilds) September 27, 2026

Moreover, North Korea, a sanctioned state, has already utilized THORChain to transfer over $1 billion from Bybit. Both Bybit and investigators traced the majority of the February 2025 attack through THORChain, where the Lazarus Group turned it into Bitcoin.

Bitget Customers' Next Steps

Bitget states that all customers are protected by a $464 million safeguard fund. Withdrawals are set to resume on Monday, beginning with Bitcoin at 8:00 UTC.

Chen expresses that North Korea is probably responsible. Bitget is providing a 5% reward for assistance in freezing the assets.

THORChain has yet to block the designated wallets, and despite widespread criticism for its position, the RUNE token has risen by more than 20% in the past day.