THORChain continues to maintain its permissionless stance after declining a formal request to block addresses linked to the Bitget security incident. As of reports around September 27–28, 2026, the cross-chain protocol rejected Bitget CEO Gracy Chen’s call to refuse service to wallets associated with the approximately $387.5 million breach that occurred on September 24.
The refusal still stands even as critics highlight THORChain’s earlier decision to pause activity following its own roughly $10 million vault exploit in May 2026. Stolen funds from the Bitget incident have continued to move through the protocol, including swaps into Bitcoin. This comparison underscores the tension between strict neutrality and selective intervention in decentralized infrastructure.
The Drivers of the Refusal
The key factor remains THORChain’s stated design as a decentralized and permissionless network. In its public response, the protocol compared itself to Bitcoin, Ethereum, and BNB Chain, questioning what responsibility those networks should bear when handling known stolen funds. Officials indicated that the system lacks mechanisms for address-level blocking without compromising its core principles.
This stacks with the contrast drawn by industry figures. OKX founder Star Xu and others noted that THORChain had previously halted operations to protect its own liquidity pools after the May incident. Critics argue that the ability to pause for self-protection demonstrates technical capacity for intervention, making the current refusal a policy choice rather than a pure technical limitation. Bitget has publicly listed attacker addresses and offered a bounty for assistance in freezing funds, while portions of the stolen assets continued routing through THORChain. Only a protocol-level decision to alter its permissionless model would enable selective blocking; no such change has been implemented.
It is essential to distinguish: THORChain’s refusal applies to requests for address-specific service denial on its cross-chain swap infrastructure, whereas earlier pauses were emergency measures aimed at protecting the protocol’s own vaults and liquidity. The current position is mostly a defense of neutrality linked to its long-standing architecture rather than an endorsement of illicit activity.
Impact and Broader Context
As THORChain declines to block the Bitget-linked funds, the episode advances a longstanding industry debate over the limits of decentralization when large stolen sums are involved. Maintaining open access grows consistency with the protocol’s stated principles, yet it also draws scrutiny over the practical consequences for victims of major exchange hacks. Analytics firms and exchanges continue to track the flow of assets through the network.
This sustained controversy fuels discussions on the responsibilities of cross-chain bridges and liquidity protocols, the difference between emergency self-protection and selective censorship, the challenges of recovering funds once they reach permissionless systems, and the broader tension between neutrality and accountability in DeFi. Protocol defenders emphasize that selective blocking would undermine the core value proposition of permissionless infrastructure. Critics contend that demonstrated halt capabilities create an expectation of action against clearly identified stolen assets.
Market and security observers note that once assets are swapped into more difficult-to-freeze forms such as Bitcoin, recovery prospects diminish further. The September exchange between Bitget and THORChain offers insight into how decentralized protocols navigate high-profile requests to intervene in the aftermath of major hacks.
As further on-chain movements, official statements, or industry responses develop, the implications of THORChain’s stance will become clearer.
This analysis draws from public statements by Bitget, THORChain, and contemporaneous reporting for precision. Fund flows and protocol policies remain subject to ongoing on-chain activity and governance decisions.