Hackers stole $387.5 million from crypto exchange Bitget on September 24. Part of it is now being turned into Bitcoin through THORChain, which refuses to block it.
THORChain lets anyone swap a coin on one blockchain for a coin on another, with no ID check. Once it becomes Bitcoin, no company can freeze it.
Bitget Asks THORChain to Turn the Hacker Away
The hacker’s wallets are public and tracked. Bitget CEO Gracy Chen asked THORChain to refuse them.
“Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching,” she said.
Blockchain tracker MistTrack says this has happened before. After the $1.46 billion Bybit hack last year, nearly $1.2 billion was reportedly traced through THORChain.
THORChain Says It Is No Different From Bitcoin
THORChain pushed back. It calls itself permissionless, open to anyone, just like Bitcoin, Ethereum, and BNB Chain.
“What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?” the team stated.
This response questions what responsibility those base blockchains bear for handling known stolen funds, deflecting calls for THORChain to block or monitor illicit flows.
It highlights core crypto tensions between permissionless cross-chain swapping on THORChain and industry demands for protocols to address publicly tracked hacker addresses.
THORChain Has Hit Pause Before
Star Xu, founder of rival exchange OKX, called THORChain’s Bitcoin comparison “False!” This follows a May incident where THORChain paused a vault after roughly $10 million was drained, its own report shows.
“A network that can stop when its own funds are at risk, but refuses to do so when someone else’s funds are at risk, is not “like Bitcoin,”” the OKX executive slammed.
May was not the first time. Nodes rapidly halted the network after a 2021 hack. In January 2025, they voted to freeze its lending and savings products.
Further, a sanctioned state, North Korea, already used THORChain to move over $1 billion from Bybit. Researchers and Bybit itself traced the bulk of the February 2025 attack through THORChain as Lazarus Group converted it to Bitcoin.
What Happens to Bitget Users
Bitget says a $464 million protection fund covers every customer. Withdrawals restart Monday, starting with Bitcoin at 8:00 UTC.
Chen says North Korea was very likely behind it. Bitget is offering a 5% bounty for help freezing the funds.
THORChain has still not blocked the flagged wallets, and despite all manner of slamming for its stance, the network’s RUNE token is up by over 20% in the last 24 hours.
