Why did the THORChain Bitget hack see no address freeze? Learn how decentralized cross-chain architecture and missing admin keys shape the $387M dispute.
Bitget says assets worth approximately $387.5 million were transferred to attacker-controlled addresses, up from an initial estimate of $351.6 million. Part of that haul is being converted into Bitcoin through THORChain, a protocol that swaps coins across blockchains. It has declined the exchange's request to stop serving the attacker's wallets. The THORChain Bitget hack dispute has become a public argument among Bitget CEO Gracy Chen, OKX founder Star Xu, blockchain security firm SlowMist, and THORChain itself.
The argument matters beyond one exchange. Once stolen tokens become native Bitcoin, no company can freeze them. Stablecoins like USDT are different, because their issuers can block balances. That makes the swap step a potential chokepoint, and it raises a practical question with legal consequences: when a protocol calls itself "decentralized" and "non-custodial," what can it actually control?
This article sets out the sequence of events, each party's argument in its own terms, what THORChain's documented tools can and cannot do, how much money appears to have moved, and what US policy adds to the picture. It does not take a side on whether THORChain should block the funds.
According to CoinDesk's reporting, Chen said attackers compromised a wallet backend and spoofed transaction data, rather than obtaining private keys. The Sept. 24 breach hit part of Bitget's hot and warm wallet infrastructure, while its cold wallets stayed secure, according to the exchange.
| Date (2026) | Event |
| Sept. 24 | Bitget breach; initial loss estimate $351.6M |
| Following days | Estimate revised to $387.5M after additional Zcash and Tron transfers were identified |
| Sept. 26 | Chen asks THORChain to refuse the published attacker addresses at 11:44 UTC; THORChain declines at 18:17 UTC |
| Sept. 27 | XRP continues swapping into Bitcoin |
| Sept. 28 | THORChain posts follow-up defending its position; Bitget begins phased withdrawal restart with Bitcoin at 08:00 UTC, with other assets scheduled through Oct. 2 |
Chen's request was direct. She wrote that "decentralization is a design principle, not a shield for facilitating known stolen funds," and added that the industry was watching.
THORChain's reply expressed sympathy and then drew a comparison. It described itself as "decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain" and asked what responsibility those networks should bear when known stolen funds pass through them. The implication is that nobody asks Bitcoin miners to reject coins, so nobody should ask THORChain's node operators either. Some replies on X pushed the same point back at Chen by asking why she wasn't also asking Bitcoin miners to stop the funds.
In a Sept. 28 follow-up, THORChain said that during its May exploit, the attackers' addresses were never blacklisted and never prevented from swapping. The argument is consistency. The protocol did not blacklist the people who stole from THORChain itself, so it is not singling out Bitget's attacker for special treatment.
Star Xu called the Bitcoin comparison "False!" His argument turns on how THORChain holds assets. Xu argued that THORChain's selected validator set collectively controls assets held inside its TSS vaults and can move those assets once the required signing threshold is reached. He framed the model as an intermediary between users and the native chains, summarizing it in one line: "Distributing an intermediary does not eliminate the intermediary."
Xu's second point concerned intervention. He argued that a network willing to stop when its own funds are at risk, but not when someone else's funds are at risk, cannot claim to behave like Bitcoin. Bitcoin has no validator set that holds users' coins and no coordinated halt mechanism.
The two claims "THORChain can pause" and "THORChain can block one address" are different, and much of the public debate blurs them.
The pause capability is documented. CryptoAdventure's review of THORChain's documentation found that node operators can trigger a 720-block network pause, and that nodes can vote through Mimir, the protocol's on-chain parameter system, to halt signing for individual chains. THORChain's own May 2026 incident report shows these tools in use. Automatic solvency controls first halted signing and trading across several chains after about $10.7 million was drained, and node operators then stacked manual pauses and Mimir votes to reach a full controlled halt within roughly two hours.
That response is where Xu's example needs correcting. Some coverage repeated a figure of about 13 hours offline. The network was actually down far longer. It remained offline for roughly five weeks before trading resumed in late June, after patched threshold-signature code was deployed.
A targeted blocklist is not described. The published documentation reviewed by CryptoAdventure does not describe a way to blacklist one external wallet while other swaps keep running. THORChain's control over its own admin tooling is also narrower than before. Cointelegraph notes that the protocol's ability to blacklist specific addresses is unclear, since it said in February 2025 that it had retired the admin key that would have allowed it.
THORChain draws the same line. It says its emergency halt tools are not meant to freeze individual addresses. Critics answer that a chain-level halt is still a choice. GoPlus Security said node votes can pause signing on a single chain, which would stop the flow at the cost of stopping every other user on that chain too. Crypto author Anndy Lian made a similar point: THORChain can halt trading, outbound transactions, or a connected chain, but those steps hit users broadly.
The terms get used loosely, so it helps to separate them.
THORChain sits in between. No single operator holds a full vault key, which supports its non-custodial claim. However, a threshold of active validators can sign outbound transactions, and node operators can vote to halt. That is a smaller, more identifiable group than Bitcoin's miners.
| System | Who can stop a specific transfer? | Practical freeze ability |
| Centralized exchange (e.g., Bitget) | The company | Can freeze individual accounts |
| Stablecoin issuer (USDT, USDC) | The issuer | Can freeze balances at an address |
| THORChain | Node operators, collectively | Can halt chains or the network; single-address blocking not documented |
| Bitcoin base layer | No coordinating body | No practical freeze mechanism |
This explains why the swap step carries so much weight. Circle and Tether froze about $318,000 in USDC and USDT at a wallet linked to the attack, which is a small fraction of the total. MistTrack data also shows attacker-linked addresses holding more than 63,000 ETH, an asset no stablecoin issuer can freeze. Once ETH or XRP passes through THORChain and comes out as native BTC, the remaining off-ramps are mainly centralized exchanges further downstream.
Security researchers mostly sided against THORChain's framing, while privacy-focused voices pushed back on Bitget.
These positions do not map neatly onto "pro-crime" and "anti-crime." Valenzuela's concern is about who decides what is "known stolen" and what happens when that power is later applied to politically disfavored users. Monahan's and SlowMist's concern is that a protocol that already coordinates halts has taken on a gatekeeping role, whether it admits it or not.
This is not a new fight. Chen says about $1.2 billion of the $1.46 billion stolen from Bybit in February 2025 passed through THORChain. Bybit CEO Ben Zhou gave a narrower figure at the time: around 72% of roughly $900 million in converted assets.
During that episode, the protocol's governance was tested directly. Three validators voted to halt Ethereum trading as stolen Bybit funds moved through the protocol, and developer Oleg Petrov later said the action was reversed within minutes. Core contributor Pluto, who had pushed for intervention, then said he would stop contributing to THORChain, while founder John-Paul Thorbjornsen opposed letting outside parties dynamically update protocol-level deny lists.
The episode shows two things at once. Validators can vote to act, so the capability exists in some form. But the network's governance rejected using it against specific flows, and the person who pushed hardest left.
Estimates differ sharply, and none comes from THORChain or Bitget.
THORChain is also not the only route. AMLBot traced roughly 4 BTC from the breach into a Wasabi Wallet CoinJoin round, after a path that ran from a Tron wallet through USDT, Ethereum and THORChain. A mixer like this is designed to break the on-chain link between coins and their source, which makes further tracing harder.
The market reaction complicates the debate, although it does not settle it. AMBCrypto reported THORChain's fees rising to about $479,000 from about $145,000 as activity surged after the hack. The same outlet reported RUNE up 15.8% over the prior 24 hours at the time of its report.
These figures are market context, not evidence that the market approves of THORChain's stance. Higher volume mechanically produces higher fees, and a token can rally on attention alone. They matter for the debate because critics such as GoPlus argue the fee income gives the network a financial reason not to act. Supporters would answer that the policy was set in February 2025, long before this incident.
For US readers, the attribution question is where the dispute meets law. Bitget says the attack method is highly consistent with known North Korean hacker patterns, and Chen cited IP and VPN similarities. No government has attributed the Bitget attack, so North Korean involvement remains possible, not established.
The Bybit case shows how quickly that can change. The FBI formally attributed that theft to North Korea, and its notice explicitly asked private-sector services to block transactions involving the listed addresses. North Korea is under comprehensive US sanctions administered by the Treasury's Office of Foreign Assets Control (OFAC), which generally bars US persons from dealing in property of sanctioned parties.
The harder legal question is who counts as the service provider. In the Tornado Cash litigation, a US appeals court ruled in 2024 that immutable smart contracts could not be sanctioned as "property," and Treasury lifted those sanctions in 2025. THORChain's case differs because it has identifiable node operators who vote on halts. That operational control is exactly what Xu and GoPlus point to, and it is the kind of fact regulators tend to examine.
| Risk | Classification | Mechanism |
| Continued laundering of flagged funds | Confirmed | Swaps into native BTC remove issuer freeze options; mixers further break tracing |
| Regulatory attention on cross-chain protocols | Emerging | Documented halt powers weaken the "no one can act" defense if a government attributes the attack |
| Pressure on individual node operators | Scenario | Identifiable operators could face legal or reputational pressure in their home jurisdictions |
| Censorship precedent | Scenario | A blocklist created for one case could be extended to other users, per Valenzuela's argument |
| Reputational damage and liquidity flight | Speculative | Integrators or liquidity providers could reduce exposure if the protocol is seen as a laundering route |
| Governance fracture | Emerging | Bybit showed a validator vote can be reversed and contributors can leave over the issue |
There is also a data risk for readers. Loss figures, flow estimates and attribution statements are coming from interested parties and private analytics firms, and several have already been revised.
As of Sept. 28, no public node vote to pause Bitget-linked flows had been recorded. A Mimir vote to halt a specific chain would be the clearest sign that the protocol's position has shifted. On Bitget's side, the exchange says a $464 million protection fund covers every customer and is offering a 5% bounty for help freezing funds. Whether withdrawals finish restarting on schedule through Oct. 2 is the practical test of that claim.
The most consequential signal would come from a government. An FBI or Treasury attribution of the THORChain Bitget hack to a sanctioned state would change the question from "should THORChain act?" to "what are node operators' legal obligations?" Until then, the THORChain Bitget hack remains a dispute over definitions, and the answer depends on which capability people are talking about: a network-wide pause that clearly exists, or a single-address block that the protocol says it does not have.
A TSS (threshold signature scheme) vault is a pool of crypto whose signing key is split among many validators, so a transaction only goes through when enough of them sign together. No single operator holds the full key. That design is why THORChain calls itself non-custodial, and also why critics say the validator group collectively controls the funds.
Native Bitcoin has no issuer or central operator with power to freeze an address. Stablecoins like USDT and USDC can be frozen because Tether and Circle control their contracts. This is why the swap from ETH or XRP into BTC matters so much in the THORChain Bitget hack: after conversion, freezing depends on catching funds at a downstream exchange.
Bitget says no customer should bear the loss, because its $464 million protection fund covers affected users. The exchange also says its cold wallets were not compromised. As of Sept. 28, Bitget was restoring withdrawals in phases, starting with Bitcoin and scheduled to cover remaining assets by Oct. 2.
North Korean involvement is possible but not confirmed as of Sept. 29, 2026. Bitget says the attack pattern resembles known North Korean methods and cites IP and VPN similarities, but no government has attributed the attack. By contrast, the FBI did formally attribute the 2025 Bybit theft to North Korea.
Why did Uptober fail in 2026? Sticky US inflation and a Binance hot-wallet breach triggered $1.5B in liquidations. Examine November seasonality data.
Read article
Bitcoin price today tests the $80,000 support as crypto liquidations hit $1.16B. Analyze the bitcoin ETF outflows, macro risks, and Q4 forecast scenarios.
Read article
Analyze crypto liquidity one year later. Bitcoin market depth recovers, but altcoin liquidity remains impaired following the October 10 crypto crash.
Read article
Curious why the crypto market structure held after Congress stalled? Discover how SEC action and short squeezes drove BTC, SOL, and HYPE to fresh highs.
Read articleDisclaimer: This article is provided for informational and educational purposes only and does not constitute financial, legal, or investment advice. It contains no buy/sell recommendations of any kind. Readers should conduct their own research and consult a qualified professional before making any financial decisions.