THORChain Pushes Back on Bitget’s Demand to Block Hacker Addresses

THORChain pushed back on Bitget CEO Gracy Chen’s demand to block addresses linked to the exchange’s hack, invoking its permissionless design while an address flagged by Bitget continued swapping $XRP for bitcoin.

A transaction recorded at 3:14 a.m. ET on Sept. 27 sent 9,999 $XRP from an address on Bitget’s attacker list. THORChain’s Midgard transaction index marked the $XRP-to-bitcoin swap successful and identified its Bitcoin payout transaction. The swap followed both Chen’s Sept. 26 request and THORChain’s response later that day.

Bitget said approximately $387.5 million in assets were transferred to attacker-controlled addresses in the Sept. 24 incident. Chen is seeking to cut off access to THORChain’s cross-chain swaps as the exchange tries to trace and recover those funds.

“THORChain is decentralized and permissionless like Bitcoin, Ethereum, and $BNB Chain,” the protocol’s official account wrote on Sept. 26, tagging Chen and OKX’s Star Xu. It asked: “What responsibility should Bitcoin, Ethereum, and $BNB Chain bear when handling known stolen funds?”

Chen’s request was directed at identified addresses: “We are formally asking @THORChain to refuse service to these addresses.” She argued that decentralization was “a design principle, not a shield for facilitating known stolen funds.”

Her post quoted MistTrack, the tracking platform built by security firm SlowMist. MistTrack said on Sept. 25 that it was observing Bitget exploit-linked funds entering THORChain for swaps and cross-chain transfers. It called for the industry to address the protocol’s responsibility for handling known stolen funds, arguing that the addresses were already publicly flagged.

The Dispute Over Network Controls

OKX founder and CEO Star Xu challenged THORChain’s comparison, arguing that its validators collectively control assets held in vaults through a threshold-signature system, which requires multiple participants to authorize transactions.

“TSS distributes control among multiple parties, but distributing an intermediary does not eliminate the intermediary,” Xu wrote.

THORChain’s developer documentation describes controls to stop swaps involving a particular chain, stop outbound signing, or halt trading across all connected chains. Nodes can vote to change these settings through the protocol’s Mimir system. Those broad trading halts are distinct from Chen’s request to refuse service to particular addresses: a chain-wide halt would also interrupt other users’ swaps on that chain.

The disagreement revisits a dispute following the Bybit hack in 2025. As The Defiant previously reported, a vote to halt ETH-to-BTC swaps passed before other voters reversed it.

Bitget has published a live attacker-address API and is offering bounties of 5% of eligible successfully frozen funds and 5% of eligible successfully recovered funds. Its terms exclude actions taken under court orders, law-enforcement requests or other legal processes.