THORChain refuses to block wallets linked to Bitget hack

THORChain has refused to block wallets holding funds stolen from Bitget, even after the exchange publicly identified them and asked the network to stop the transfers. The decision matters because THORChain can turn assets on one blockchain into Bitcoin without an identity check. Once that Bitcoin exists, no company can freeze it.

That choice has turned a $387.5 million theft into a test of who should be responsible for stolen crypto in a system built around open access.

A flagged address moved from XRP to Bitcoin

Bitget CEO Gracy Chen asked THORChain to reject the hackers' publicly tracked wallets. Her request followed the theft on September 24. BeInCrypto reported that part of the haul was being converted into Bitcoin through THORChain.

The sequence since that request is clear. An address flagged by Bitget completed an XRP-to-Bitcoin swap on THORChain after Chen made her appeal, according to The Defiant.

The exact amount moved through THORChain and the number of flagged addresses are not disclosed in the reporting reviewed for this article. So the available evidence does not show how much of Bitget's loss has already entered Bitcoin through the network.

Why blocking is difficult in a cross-chain swap

THORChain's job is to let users exchange one coin for another across different blockchains. The process requires no identity check. A user can arrive with one asset and leave with another, without giving THORChain a name to attach to the transaction.

That is useful for users who don't want an exchange account. It also makes a targeted block dependent on the network accepting and enforcing a new restriction. Once the output asset is Bitcoin, the receiving address is controlled by its owner, not by a company that can reverse the transfer.

THORChain describes itself as permissionless and open to anyone, comparing the network with Bitcoin, Ethereum and BNB Chain. The team also asked what responsibility those base chains should carry when they handle known stolen funds.

The comparison is the centre of the dispute. Chen sees it as a principle, not a technical defence:

“Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching,” she said.

OKX founder Star Xu rejected THORChain's comparison with Bitcoin. His argument rests on the network's previous pauses. THORChain nodes halted activity after a 2021 hack, and in January 2025 they voted to freeze the lending and savings products. In May, the network also paused a vault after roughly $10 million was drained, according to THORChain's own account of the incident.

Xu's concern is specific. A network that can stop when its own systems face losses may be making risk-based decisions. Refusing to stop a publicly identified theft is a different choice. He called that distinction incompatible with the comparison to Bitcoin.

This is not THORChain's first theft dispute

The Bitget case follows a larger pattern. Blockchain tracker MistTrack reportedly traced nearly $1.2 billion in stolen funds through THORChain after the $1.46 billion Bybit hack in 2025. Researchers and Bybit also traced the bulk of that attack through THORChain, with the Lazarus Group converting stolen assets into Bitcoin, BeInCrypto reported.

Chen said North Korea was very likely behind the Bitget attack and offered a 5% bounty for information that could help freeze the funds. That attribution comes from Chen and has not been independently confirmed in the reporting reviewed for this article.

Bitget, meanwhile, says a $464 million protection fund covers every customer. The exchange plans to restart withdrawals on Monday, beginning with Bitcoin at 08:00 UTC. The reviewed pages do not reconcile how that fund relates to the $387.5 million theft.

The limit is clear, but so is the trade-off

THORChain did what its open design allowed. It processed a flagged cross-chain swap and produced Bitcoin that no company can freeze. That does not make the swap harmless. It makes the protection problem harder once the funds have crossed into a bearer asset.

The dispute will likely be judged less by THORChain's slogan than by the rule it follows. If known stolen assets can still pass through the network, users gain privacy and access, while platforms lose one possible place to stop a theft. Chen and Xu see that as a failed safeguard. THORChain sees it as the price of staying permissionless.

So far, the network has not blocked the wallets. That makes this more than a dispute over public relations. It is a practical test of whether cross-chain systems can remain open without becoming a convenient route for stolen funds.