THORChain refuses to block funds linked to the Bitget hack, asserting its decentralized nature and operational principles.
THORChain has decided against halting its network to block funds associated with the recent Bitget exchange hack, in which approximately $387.5 million was stolen.
"A THORChain network halt is an emergency safety measure intended to protect the protocol. It is not a selective freeze of specific funds or a block on individual swaps. THORChain operates without permissions and, by design, does not enforce censorship," the team stated.
The hack occurred on September 24, when a hacker accessed Bitget's hot and warm wallets by compromising a critical backend component, allowing unauthorized transfers without any reported private key leaks. Following the incident, the hacker utilized THORChain to move stolen funds.
Gracy Chen, Bitget's CEO, urged THORChain developers on September 26 not to process transactions from the addresses linked to the attacker, emphasizing that decentralization should not protect criminal activity.
Network Operations and Governance
THORChain has the capability to halt its network, as demonstrated in May 2026 when an automated system stopped trading following a $10.7 million attack. However, the protocol clarified that it does not block specific addresses, maintaining its commitment to operating without a centralized authority.
Since February 2025, the network has been governed by node operators, and any decision to halt operations requires a vote from three operators. The developers likened THORChain's operational model to that of Bitcoin and Ethereum, asserting that it does not control who can conduct transactions.
Despite this, experts from GoPlus Security argued that THORChain's architecture could allow for freezing stolen assets without hampering the entire network. They pointed out that THORChain's governance structure differs significantly from decentralized layer one networks.
In the wake of the Bitget hack, it is notable that THORChain's lead developer, Pluto, departed the project after a previous vote to block transactions linked to hackers was canceled, raising concerns about the protocol's vulnerabilities to criminal use.
