Following a $387.5 million theft from cryptocurrency exchange Bitget on September 24, a portion of the stolen funds is currently being converted into Bitcoin via THORChain, which has declined to block the transactions.
By utilizing THORChain, users can exchange tokens across different blockchains without undergoing any identity verification. Once these assets are converted into Bitcoin, freezing them becomes impossible for any corporate entity.
Bitget Asks THORChain to Turn the Hacker Away
The hacker’s wallet addresses are publicly known and actively monitored. In response, Bitget CEO Gracy Chen appealed to THORChain to reject these transactions.
“Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching,” she said.
According to blockchain analytics firm MistTrack, a similar situation occurred previously. Following last year’s $1.46 billion Bybit hack, reports indicated that nearly $1.2 billion was traced through THORChain.
THORChain Says It Is No Different From Bitcoin
THORChain defended its position by describing itself as a permissionless network accessible to anyone, comparing its operations to those of Bitcoin, Ethereum, and BNB Chain.
“What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?” the team stated.
This statement challenges the accountability of underlying blockchains in processing illicit funds, thereby deflecting demands for THORChain to monitor or restrict such transactions.
This situation underscores the ongoing friction within the crypto sector between THORChain’s permissionless cross-chain architecture and broader industry expectations for protocols to intervene against publicly identified hacker addresses.
THORChain Has Hit Pause Before
Star Xu, the founder of competitor exchange OKX, dismissed THORChain’s comparison to Bitcoin as “False!” He pointed to a May incident detailed in THORChain’s own report where the network temporarily paused a vault after losing roughly $10 million.
“A network that can stop when its own funds are at risk, but refuses to do so when someone else’s funds are at risk, is not “like Bitcoin,”” the OKX executive slammed.
May was not an isolated instance. Network nodes acted quickly to halt operations following a 2021 hack, and in January 2025, they voted to freeze the platform’s lending and savings services.
Additionally, North Korea, a sanctioned state, previously utilized THORChain to launder over $1 billion stemming from the Bybit attack. Bybit and security researchers traced the majority of the February 2025 exploit through THORChain as the Lazarus Group converted the stolen funds into Bitcoin.
What Happens to Bitget Users
Bitget has assured users that a $464 million protection fund will cover all customer assets. Withdrawals are scheduled to resume on Monday, starting with Bitcoin transactions at 8:00 UTC.
Chen noted that North Korea was very likely responsible for the breach. Bitget is currently providing a 5% bounty for assistance in freezing the stolen capital.
Despite heavy criticism over its refusal to block the flagged wallets, THORChain’s native RUNE token has climbed more than 20% over the past 24 hours.