THORChain Refuses Bitget Plea to Block Hacker Wallets

THORChain has refused a formal request from Bitget chief executive Gracy Chen to block wallets tied to the theft of about $387.5 million from the exchange on September 24. The cross-chain network said it is decentralized and permissionless, comparing itself to Bitcoin, in a reply to Chen's appeal.

Chen made the request on X, tagging THORChain's official account and asking the network to refuse service to the attackers' addresses. "Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching," she wrote, according to Bitcoin.com News, whose description BeInCrypto's account matches.

The hacker's wallets are public and tracked. Part of the stolen money is now being converted into bitcoin through THORChain, which lets anyone swap a coin on one chain for a coin on another with no ID check, BeInCrypto reported in that account. Once the funds become bitcoin, no company can freeze them.

THORChain pushed back on the request. Its team expressed sympathy over the hack but held that the protocol is "decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain." The response then asked what responsibility Bitcoin, Ethereum and BNB Chain bear when known stolen funds move across their networks.

That comparison drew a direct rebuttal from Star Xu, founder and chief executive of rival exchange OKX. Xu wrote on X that he does not think THORChain's threshold-signature and validator model counts as true decentralization. The selected validators jointly control the assets in the network's vaults, he argued, so once enough of them sign, they can move the funds. From a custody view, he said, THORChain works as an intermediary between users and the native chains rather than as a base layer like Bitcoin or Ethereum.

Xu pointed to May, when THORChain paused a vault after roughly $10 million was drained. "A network that can stop when its own funds are at risk, but refuses to do so when someone else's funds are at risk, is not 'like Bitcoin,'" he wrote. "Bitcoin cannot be stopped. THORChain can, it simply chooses when to do so." Bitcoin.com News quoted that exchange in full, and BeInCrypto's version records the same May pause and adds two earlier ones: node operators halted the network after a 2021 hack and voted in January 2025 to freeze its lending and savings products.

Others defended THORChain. Joel Valenzuela, a business development and marketing lead for Dashpay, answered Chen directly: "Shame on you, Gracy Chen." He called the request unfair in a stressful moment and said nobody asks Bitcoin or Ethereum to reverse transactions, even though both networks have rolled back their chains in the past, Ethereum explicitly to undo an exploit. His reply drew a back-and-forth with Xu, who answered "False" to the claim that THORChain has no central authority or censorship mechanism.

The fight revives the controversy from the February 2025 Bybit hack, when attackers moved an estimated $1.2 billion through THORChain. Blockchain tracker MistTrack flagged the repeat in a September 25 post, noting that nearly $1.2 billion from the $1.46 billion Bybit theft was traced through the network. Bybit founder Ben Zhou told Chen on X that Bybit would stand by to help, adding that the exchange is updating its Lazarus bounty page to trace the Bitget-related flows.

For Bitget users, the exchange says a $464 million protection fund covers every customer. Withdrawals restart Monday, starting with bitcoin at 8:00 UTC, according to the report. Chen has said North Korea was very likely behind the attack, and Bitget is offering a 5 percent bounty for help freezing the funds. THORChain, for its part, had still not blocked the flagged wallets at the time of that report, even as its RUNE token rose more than 20 percent in the preceding 24 hours.