The Bitget hack has sparked a new debate over crypto’s biggest promise of decentralization. After hackers routed stolen funds through THORChain and converted assets into Bitcoin, Bitget CEO Gracy Chen asked the protocol to block the attacker addresses.
THORChain rejected the request, saying its permissionless design does not allow it to censor transactions.
How Did the Bitget Hacker Use THORChain?
Following the 24 September 2026 Bitget breach, blockchain security firms TRM Labs and SlowMist’s MistTrack tracked how the stolen funds moved across different networks.
According to blockchain tracking firms, the hackers first swapped stolen USDT and USDC into ETH and BNB to avoid freezes by issuers such as Tether and Circle.
Yet, Circle and Tether managed to freeze 218,023 USDT and 99,990 USDC, worth about $318,000 combined, from an attacker linked address.
Over the next 13 hours, the attackers moved millions of dollars in ETH and BNB through THORChain, a cross-chain protocol that allows direct swaps between different blockchains without using wrapped tokens. This allowed hackers to convert part of the stolen funds into native Bitcoin (BTC).
The newly converted BTC was then spread across thousands of private wallets, making the funds harder to track and recover.
Until now, hackers have moved about $4 million–$4.5 million of the stolen $387.5 million through THORChain and converted it into Bitcoin.
THORChain Rejects Bitget’s Request
The movement triggered a public clash between Bitget and THORChain.
Bitget CEO Gracy Chen called on THORChain validators to block addresses linked to the attackers. Chen argued that decentralization should not prevent networks from responding to known stolen funds.
THORChain rejected the request, saying it is a decentralized, permissionless network similar in design to Bitcoin and Ethereum. The protocol said blocking selected transactions would go against how its system operates.
“What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?”
THORChain Faces Criticism Over Its Role
The THORChain team’s response has drawn criticism from crypto security experts. SlowMist founder Cosine pointed to THORChain’s handling of earlier incidents and questioned whether the network should take action when stolen funds are clearly identified.
The decision has drawn criticism from security experts, including SlowMist founder Cosine, who questioned THORChain’s response to funds linked to major hacks.
After the $1.46 billion Bybit hack, nearly $1.2 billion in stolen funds reportedly moved through THORChain. Now, funds linked to the Bitget hack are also being sent through the network for swaps.
The attacker wallets have already been flagged and are being tracked by exchanges and security firms. Critics say this raises questions about whether THORChain could do more to stop the funds.
They also point to past incidents when THORChain developers used a “red button” to pause the network during an exploit.
Critics argue that the network is now continuing to process stolen funds and collect fees from these transactions.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
