THORChain refuses to block funds from the $387.5 million breach, and the dispute shows where a freeze still works along a crypto route.
On September 24, 2026, attackers took $387.5 million from Bitget, and part of the money is now moving into Bitcoin through THORChain. The Bitget hack has turned into a public argument about responsibility, with an exchange asking a decentralised protocol to refuse service. Who along a crypto route can stop stolen funds, and who should?
What happened in the Bitget hack?
Bitget detected unauthorised transfers from its hot and warm wallets at 18:31 UTC on September 24, 2026. CEO Gracy Chen said attackers compromised a backend system in the exchange’s wallet infrastructure, spoofed transaction data and pushed the requests through Bitget’s own signing process. Bitget ruled out a private key leak, and its cold wallets stayed untouched.
The loss estimate grew in steps. On-chain trackers first counted about $174 million, Chen confirmed $351.6 million a few hours later, and Bitget later raised the figure to $387.5 million. The hack hit Bitget on the exchange’s eighth birthday.
The attackers moved fast, and the order of their moves matters:
- A test transfer of 0.84 ETH left a wallet labelled Bitget 6 at 18:31:11 UTC.
- Stablecoins followed, including about $34.75 million in USDT and $12.85 million in USDC.
- One address swapped 19.67 million USDT0 into 7,111 ETH on Arbitrum in six minutes.
- One wallet turned stablecoins and gold tokens into roughly 22,600 ETH over about 40 minutes, according to Unchained.
Speed decided the result. Circle blacklisted a wallet labelled Bitget Exploiter 8 at 05:00 UTC the next morning, and Tether followed about seven hours later. By then the wallet held about $318,000 in stablecoins, while other exploiter addresses still held more than 63,000 ETH that no issuer can touch.
Bitget paused withdrawals for five days and kept trading and deposits open. The exchange says its User Protection Fund, which holds more than $464 million, covers the full loss, and it reopened ETH withdrawals on September 29.
Why won’t THORChain freeze the stolen funds?
THORChain says its permissionless design has no tool for freezing individual addresses. When Bitget asked it to block wallets linked to the breach, THORChain answered on September 28, 2026, that its emergency halts protect the whole protocol, and compared its position with Bitcoin, Ethereum and BNB Chain.
Chen made the request in public and called the attack consistent with known North Korean hacking groups. She put her argument in one line: “Decentralization is a design principle, not a shield for facilitating known stolen funds.” SlowMist, the security firm helping Bitget trace the money, made the same appeal.
THORChain’s own record complicates its answer. The network paused in May 2026 after an exploit took $10.7 million from its vault, and it treats that halt as a different case from blocking funds stolen elsewhere. An OKX executive replied that a network able to stop for its own money cannot claim to behave like Bitcoin. In my view, the May pause moves the debate from whether THORChain can stop to when it chooses to.
Volume shows what the refusal means in practice. THORChain processed $678 million in the two days after the breach, according to its own analytics, compared with $20 million to $60 million a day the week before. The pattern echoes 2025: after the $1.46 billion Bybit theft, nearly $1.2 billion was reportedly traced through THORChain, and the swaps earned the protocol about $3 million in fees.
Where stolen crypto can still be frozen
A stolen balance passes several layers on its way out, and each one holds a different kind of power:
- Stablecoin issuers can blacklist addresses holding their tokens, as Circle and Tether did within hours.
- Exchanges can freeze or reject deposits they can trace to the theft.
- Cross-chain services set their own rules: NEAR Intents identified more than $50 million in suspicious transfer attempts, and THORChain declines to freeze.
- Bitcoin and Ethereum have no company able to freeze a balance.
Tracing gives exchanges their power. Bitcoin’s public ledger lets analytics firms follow coins between services, so exchanges can refuse deposits linked to a theft, and after the Bybit hack the FBI asked exchanges to block addresses tied to the laundering. That power depends on the funds reaching a regulated service.
The results so far are small. Only $503,000 of the funds taken in the hack at Bitget had been frozen by September 29. Circle moved faster than in April, when an attacker in the $285 million Drift hack used Circle’s own cross-chain protocol to move about $232 million in USDC from Solana to Ethereum.
Why the route ends in Bitcoin
The attackers followed a clear order: stablecoins first, then ETH, then Bitcoin through THORChain. On September 28, one address swapped about 2,390 ETH for 75.2 BTC through the protocol, and AMLBot traced about 4 BTC from the breach into a Wasabi CoinJoin round.
In my reading, the governance split between stablecoins and Bitcoin fits that direction. Stablecoins have identifiable issuers whose policies and regulatory obligations shape how the tokens work, and Bitcoin has no central issuer at all. Each hop moves the money away from someone who can act on a request and toward a network where nobody can.
The same logic shaped the Bybit laundering, and TechFlow writes that the Bitget sequence mirrors the Lazarus Group’s strategy in that case. For issuers, the window to act lasts only as long as the funds stay in their tokens.
Who carries the duty to act
The Bitget hack shows that a freeze works only where a company controls the asset or the account, and by Unchained’s count the main swaps out of that zone took about 40 minutes. My view is that the pressure will now fall on the cross-chain layer, because it is the last point where stolen crypto can still meet someone able to say no.
After the Bitget Hack, Who Should Stop Stolen Crypto? was originally published in The Capital on Medium, where people are continuing the conversation by highlighting and responding to this story.
