Bitget requires THORChain verifiers to block addresses related to the attackers.

THORChain rejected this request, stating that its decentralized and permissionless design does not allow for the review of transactions.

This controversy has once again sparked discussions about the responsibility of decentralized networks in dealing with stolen funds.

The incident of Bitget being hacked has sparked a new round of debate surrounding the core commitment of the cryptocurrency industry to “decentralization.” After the hackers used THORChain to transfer the stolen funds and exchanged them for Bitcoin, Bitget CEO Gracy Chen demanded that the protocol block the hacker’s address.

THORChain rejected this request, stating that its permission-free design does not allow it to review transactions.

Bitget How do hackers use THORChain?

After being invaded on Bitget September 24, 2026, blockchain security companies TRM Labs and SlowMist, with their subsidiary MistTrack, tracked how the stolen funds were transferred between different networks.

According to blockchain tracking companies, hackers first exchanged the stolen USDT and USDC for ETH and BNB in order to avoid them being frozen by issuers such as Tether and Circle.

However, Circle and Tether still successfully froze 218,023 USDT and 99,990 USDC from an address associated with the attacker, with a total value of approximately $318,000.

In the following 13 hours, the attackers transferred ETH and BNB, worth millions of dollars, through THORChain. THORChain is a cross-chain protocol that allows for direct exchange between different blockchains without the need to use wrapped tokens. This enabled the hackers to convert some of the stolen funds into native Bitcoin (BTC).

Subsequently, these newly converted BTC were distributed across thousands of private wallets, making it more difficult to track and recover the funds.

As of now, out of the $387.5 million in funds that were stolen, hackers have transferred and exchanged approximately $4 to $4.5 million of that amount into Bitcoin through THORChain.

THORChain Rejects the request of Bitget

The flow of this funds has triggered an open conflict between Bitget and THORChain.

Bitget Chief Executive Officer Gracy Chen calls on THORChain verifiers to block addresses associated with the attackers. Chen believes that decentralization should not prevent the network from responding to known stolen funds.

THORChain rejected this request, stating that it is a decentralized network that does not require permission and is designed similarly to Bitcoin and Ethereum. The protocol stated that blocking specific transactions would go against the way its system operates.

THORChain: "What responsibilities should Bitcoin, Ethereum, and BNB Chain assume when dealing with known stolen funds?"

THORChain faces criticism due to his role

The response from the THORChain team has drawn criticism from encryption security experts. The founder of SlowMist mentioned the way the network handled similar incidents in the past and questioned whether action should have been taken when the stolen funds were clearly identified.

This decision has also drawn criticism from security experts, including the founders of SlowMist and Cosine, who question THORChain's approach to dealing with funds related to major hacking incidents.

It is reported that after the $1.46 billion theft incident at Bybit, nearly $1.2 billion of the stolen funds were transferred through THORChain. Nowadays, funds related to the hacker attack at Bitget are also being exchanged via this network.

The wallets of these attackers have been identified, and they are now being tracked by exchanges and security companies. Critics argue that this raises the question of whether THORChain can take further measures to prevent the flow of funds.

They also pointed out that in some past incidents, the THORChain developers used a "red button" to suspend the network during the exploitation of vulnerabilities.

Critics argue that the network is still continuing to process the stolen funds and is collecting fees from these transactions.