THORChain can halt network but won’t freeze Bitget hacker

Bitget CEO Gracy Chen formally requested THORChain block addresses tied to the September 24 exploit, after the attacker routed stolen assets through the protocol. Our attacker addresses are publicly listed and actively tracked, Chen wrote on X. Decentralization is a design principle, not a shield for facilitating known stolen funds.

THORChain responded publicly on X, stating it remains permissionless and doesn’t censor by design, and compared its position to Bitcoin, Ethereum, and BNB Chain.

A Halt Is Not a Freeze

THORChain drew a clear distinction between an emergency network halt and selectively blocking funds. A halt is not a selective freeze of specific funds or an individual swap, the protocol stated. Network halts exist to protect THORChain itself during a security event, not to intervene in how individual transactions move.

The protocol pointed to its own May 2026 incident, when it lost $10.7 million and halted trading network-wide to contain the exploit, as an example of what a halt actually does. Even then, THORChain did not blacklist attacker addresses, and it has maintained that same policy now.

Critics Say the Comparison Doesn’t Hold

Not everyone is buying the Bitcoin comparison. OKX founder Star Xu pushed back directly, arguing that a network that can stop when its own funds are at risk, but refuses to do so when someone else’s funds are at risk, is not like Bitcoin.

GoPlus Security raised similar concerns, arguing THORChain has never been strictly decentralized and urging the protocol not to enable criminals by continuing to collect swap fees on stolen funds. The firm pointed to differences between THORChain’s threshold signature vaults and the architecture of networks like Bitcoin or Ethereum.

Crypto security executive Michael Perklin offered a defense, arguing that threshold signing is an automated process rather than human approval of individual transfers. He compared a THORChain node operator’s options to a Bitcoin miner powering down entirely, which halts all transactions rather than singling out illicit ones.

The Money Kept Moving

While the debate played out publicly, the attacker’s funds didn’t sit still. CoinDesk’s analysis of THORChain’s public transaction records identified 27 successful swaps converting roughly 2,390 ETH into 75.2 BTC, with all bitcoin payouts routed to a single address. Four additional swaps involving 400 ETH were still pending at the time of reporting.

Because THORChain’s swaps remain fully on-chain, researchers and security teams can trace the funds even without a freeze. That traceability doesn’t stop the movement, but it does mean the attacker isn’t operating in the dark.

Bitget Presses Ahead With Recovery

Bitget suspects North Korean-linked hackers exploited a third-party security vulnerability, allowing fraudulent withdrawal approvals without compromising the exchange’s private keys directly. Cold storage was not affected.

• Bitcoin and BSC network withdrawals have resumed
• ETH withdrawals are scheduled for September 29
• USDT withdrawals are scheduled for September 30
• Mandiant and SlowMist have been engaged to assist with the investigation

Bitget is offering a 5% bounty for any funds frozen or recovered, and says its $464 million Protection Fund will absorb the full loss so customer balances remain unaffected.

Hashlytics Take

THORChain’s technical defense is accurate. Threshold signing really is closer to automated infrastructure than a bank teller approving a wire transfer, and Perklin’s Bitcoin miner comparison holds up under scrutiny. But accuracy isn’t the same as consistency, and that’s where the protocol’s position gets shaky. THORChain halted its own network within hours when it was the victim, then invoked permissionless design as principle the moment someone else’s money was on the line. Star Xu’s framing cuts closer to the real issue than GoPlus’s decentralization purity test does. The question was never whether THORChain can intervene. It clearly can. The question is why intervention was acceptable to protect the protocol’s own treasury but not acceptable to stop hundreds of millions in traceable, publicly identified stolen funds from converting into bitcoin in real time.