THORChain has turned down a public request from Bitget to stop processing transactions from wallets tied to the exchange's $387.5 million breach, reopening one of crypto's most uncomfortable arguments: whether a cross-chain protocol that calls itself permissionless has any obligation to refuse funds everyone already knows are stolen.
The exchange's CEO, Gracy Chen, made the request on X on September 26, saying the attacker addresses had been publicly disclosed and were being tracked continuously. THORChain's answer came within hours. The protocol said it was saddened by the exploit but stressed that it is decentralized and permissionless in the same way as Bitcoin, Ethereum and BNB Chain, and would not act as a gatekeeper on which addresses can swap.
Chen had anticipated that argument before THORChain made it. In her post she wrote that decentralization should not become cover for moving stolen money:
Decentralization is a design principle, not a shield for facilitating the movement of known stolen funds.
She added that continuing to serve the attacker could carry negative implications for the broader industry, and questioned whether handling large cross-chain swaps of publicly identified stolen funds really qualifies as decentralization at all.
Where the money is going
The breach itself hit Bitget's hot and warm wallets on September 24. Early estimates put losses at $351.6 million before the figure was revised up to $387.5 million, making it the largest crypto theft of 2026 so far. Blockchain intelligence firm TRM Labs said the attackers did not steal private keys directly. Instead they compromised backend systems and manipulated the transaction data shown to Bitget's own approval process, so signers effectively authorized transfers they could not see clearly.
From there the funds scattered across Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base. According to TRM, the proceeds were first consolidated through relay wallets and then split into round-number holdings, such as 10,000 ETH and 20 million XRP per address. Conversion followed through a set of cross-chain services including THORChain, Across, Bridgers, Chainflip and FixedFloat, with the end product being Bitcoin pushed through peel chains.
That last step is why THORChain matters so much in this story. It is one of the few venues where a large holder of ETH can swap into native BTC without a centralized intermediary asking questions, and it has been the preferred route for this kind of operation before.
Related: Bitget Sets Withdrawal Restart for Sept. 28 as Hack Losses Hit $387.5M
The Bybit precedent
When Bybit lost roughly $1.4 billion in ETH in February 2025, the attackers laundered almost all of it within about ten days, and THORChain carried the bulk of it. Around $1 billion of the stolen ether was swapped to Bitcoin on the protocol, which logged a record $4.66 billion in swap volume in the week ending March 2 of that year and collected an estimated $5.5 million in fees along the way.
The episode split THORChain's own community. Validators briefly voted to pause ETH trading, the pause was reversed, and at least one core developer publicly walked away from the project in protest. The network kept running, and the protocol has since pointed to that outcome as proof that nobody, including its own contributors, can simply switch off an address.
The links between the two cases go beyond the playbook. TRM said on-chain tracing of the Bitget proceeds shows several overlaps with wallets used to launder earlier North Korean thefts, including Bybit and the AFX Bridge hack, and that the approval-data manipulation technique mirrors what happened at Bybit. Chen has said North Korean involvement is "very likely," citing IP addresses that Bitget's preliminary investigation tied to VPN services associated with a North Korean hacking group. Formal attribution is still pending an incident report. Governments have been sharpening their focus on the same actors, as seen when Japan, the US and Germany jointly exposed the WaterPlum hacking group.
What the standoff means
For Bitget, the practical goal is buying time. Every hour the attacker spends unable to convert into BTC is another hour for exchanges, stablecoin issuers and investigators to freeze pieces of the haul. The exchange has published a live tracing dashboard and an attacker-address API so other platforms can screen deposits in real time, a tactic that has recovered meaningful sums in past incidents where funds touched centralized venues. It is already working through the fallout on its own platform, having pointed to North Korea as the initial loss tally climbed.
For THORChain, the calculus has not changed since 2025. Blocking addresses at the protocol level would require its validators to agree on a blacklist, which undercuts the neutrality pitch that attracts much of its legitimate volume. Refusing, however, keeps the protocol in the uncomfortable position of earning fees on what may end up as the second-largest year on record for North Korean crypto theft. TRM noted that if the Bitget attribution is confirmed, 2026 would clear $1 billion in suspected North Korean thefts, behind only 2025.
The broader pattern is hard to ignore. Smaller DeFi exploits this month, such as the attack that hit Fetch.ai and NuNet, have also relied on cross-chain routes to cash out. Regulators who have so far aimed at centralized on-ramps may start asking harder questions about the swap layers in between, and THORChain's refusal gives them a clear example to point to.
FAQ
Why won't THORChain block the Bitget hacker's addresses?
THORChain says it is decentralized and permissionless like Bitcoin, Ethereum and BNB Chain, so it will not screen or refuse transactions from specific addresses, even ones publicly tied to the Bitget exploit.
How much was stolen in the Bitget hack?
Losses were first estimated at $351.6 million and later revised to $387.5 million, making it the largest crypto theft of 2026 so far.
Has THORChain been used to launder hacked funds before?
Yes. After the February 2025 Bybit hack, around $1 billion of stolen ETH was swapped to Bitcoin through THORChain within roughly ten days.
