THORChain refuses to block addresses linked to Bitget hack

End of refusal. Bitget asked THORChain to refuse transactions from addresses linked to the $387.5 million theft suffered by the platform on September 24. The swap protocol between blockchains invoked its permissionless operation and compared its role to that of Bitcoin or Ethereum.

The call came from Gracy Chen, CEO of Bitget, as part of the funds were converted into bitcoins through THORChain. The network has no native mechanism for blacklisting a particular wallet, although its operators can suspend certain activities more broadly.

THORChain refuses to block addresses linked to Bitget hack

THORChain allows native assets to be exchanged between multiple blockchains without going through a centralized platform or providing proof of identity. The cryptocurrencies deposited in its vaults are collectively controlled by its operators using a threshold signature system. No one holds the complete key alone.

This architecture does not include a function allowing you to ban an isolated address. However, pseudonymous operators have several security levers at their disposal. Governance settings called Mimir can suspend outgoing signatures, liquidity provision, exchanges or observation of an entire blockchain. A general pause can also be triggered and then extended by multiple nodes.

These tools therefore interrupt an entire service instead of filtering a particular transaction. Enabling them against the hacker's wallets would also block users unrelated to the attack.

Bitget claims that the hacker compromised a central system of its wallet infrastructure before falsifying transaction data and triggering its own authorization process. The private keys would not have been compromised and the cold wallets would have remained intact. A portion of the stolen assets then passed through several protocols, including THORChain, to emerge in the form of bitcoins.

After Bybit, the debate on the neutrality of THORChain returns

The closest precedent dates back to the theft of $1.5 billion suffered by Bybit in February 2025. A large part of the stolen ether was then converted into bitcoin via THORChain by a group attributed to North Korea.

The FBI had asked exchanges, cross-chain bridges, RPC node operators, DeFi services and other private actors to block transactions linked to the reported addresses. THORChain operators had considered suspending trading on Ethereum before abandoning this decision. The pseudonymous developer Pluto, in favor of intervention, had left the project.

The protocol, however, demonstrated its ability to stop when its own funds were threatened. After the theft of $10.7 million from an Asgard vault on May 15, 2026, operators shut down the network for approximately five weeks. THORChain resumed operations on June 22 after fixing the flaw affecting its signature system.

This difference fuels criticism from Star Xu, founder of OKX: THORChain can collectively suspend its operation, but refuses to do so to protect the funds of an external actor. THORChain invoked its permissionless operation and asked “what responsibility should fall on Bitcoin, Ethereum and BNB Chain when stolen funds circulate on their networks”. A good way to kick in…