THORChain rejects Bitget request to freeze hacker wallets

THORChain refused a request from Bitget to block wallets linked to the exchange's late-September hack, even as about $6.3 million in stolen ether passed through the protocol and came out as bitcoin on Monday.

CoinDesk reported the refusal on Sept. 28. The swaps ran between 03:55 and 06:23 UTC that day, moving roughly 2,390 ether into 75.2 bitcoin in batches of about 100 ether each. BTC Newz reported the original breach last week.

THORChain is a cross-chain swap protocol. It lets a user trade one coin for another across separate blockchains without a company holding the money in between. That design is the whole appeal for its users. It is also what makes stolen funds hard to stop once they arrive.

What Bitget asked for

Bitget wants the funds frozen. Gracy Chen, the exchange's chief executive, made the request in the open. "Our attacker addresses are publicly listed and actively tracked," she wrote. "We are formally asking @THORChain to refuse service to these addresses. Decentralization is a design principle, not a shield for facilitating known stolen funds."

The size of the loss is still contested. Bitget and blockchain intelligence firm TRM Labs put the theft at about $351.6 million, a figure TRM said it confirmed on Sept. 25 through on-chain analysis. CoinDesk and the outlet Unchained have since cited a larger number, $387.5 million. The breach happened on Sept. 24, when attackers reached a backend system tied to Bitget's wallet setup and pushed through transfers the exchange never approved. No private keys were taken.

Where the money went

Most of the money is still gone. The theft hit eight blockchains at once, in two bursts at 19:01 and 19:16 UTC on Sept. 24, according to on-chain analysis by Bitquery. The largest pieces were XRP, worth about $157.8 million, and Ethereum assets worth around $126.6 million. More than 90 percent of the stolen XRP was later swapped for bitcoin, Bitquery found.

Freezing has done little. Stablecoin issuers Circle and Tether locked about $339,000 between them, a sliver of the total. Coins such as XRP, ether and tron have no issuer that can freeze them, which is why the attacker leaned on swaps into bitcoin. Roughly 48,923 ether, about $129.7 million, still sat untouched in six wallets as of 07:00 UTC on Sept. 28.

Why THORChain said no

THORChain said no. Its operators said the only emergency tool they have is a network-wide halt, built to protect the protocol itself, not a switch that freezes one wallet or a single swap. "A THORChain network halt is an emergency security mechanism designed to protect the protocol," the network said. "A halt is not a selective freeze of specific funds or an individual swap."

In its own words, THORChain "doesn't censor by design." Michael Perklin, a security executive who weighed in on the row, argued that "all tools in existence are inherently neutral by nature." Not everyone buys that line. A halt would stop every honest user mid-swap, so the refusal is a real choice, and validators have debated stepping in before.

A familiar fight

This has happened before. After the 2025 Bybit hack, North Korea's Lazarus Group ran much of its ether through THORChain and turned it into bitcoin, the same route seen this week. The protocol will halt for its own safety, though. A $10.7 million vault attack in May 2026 froze the network for about five weeks, and trading resumed on June 22.

Attribution is not settled. Chen said North Korea was "very likely" behind the Bitget theft, pointing to IP addresses tied to VPN services used by North Korean groups. TRM Labs was more guarded, saying it had not definitively attributed the attack but had found on-chain overlaps with earlier North Korean operations. If the link holds, TRM said, 2026 would rank as the second-worst year on record for North Korean crypto theft, above $1 billion.

What to watch

Two things matter next. The first is whether the rest of the stolen funds keep flowing through THORChain, which would keep pressure on its validators and its no-censorship stance. The second is regulatory. Watchdogs in several countries have grown less patient with decentralized services that stolen money passes through, and a theft this large, tied to a suspected state actor, is the kind that pulls their attention.