Major Exchange hack sparks DEX neutrality debate

TLDR

A large hack on centralized exchange Bitget and laundering via THORChain has triggered a fierce debate over whether DEXs should stay neutral or block known stolen funds.

1. Bitget (a major CEX) lost about $387.5 million, with attackers routing stolen assets through THORChain and other cross-chain DeFi rails for swaps and mixing.
2. Bitgets CEO and security firms are publicly pressuring THORChain to block known hacker addresses, while THORChain defends a permissionless, neutral infrastructure stance.
3. The clash exposes a fault line in crypto governance, and future norms may hinge on how protocols balance censorship resistance with pressure from regulators and hacked venues.

Confidence: high because multiple independent reports and public statements describe both the Bitget hack and the THORChain debate.

Deep Dive

1. Scale And Mechanics Of The Bitget Hack

Bitget says about $387.5 million in crypto was drained from its hot and warm wallets during a September 24 security breach, up from an initial $351.6 million estimate after further tracing on Zcash and TRON transfers. The largest single asset loss was roughly 103 million XRP, alongside ETH, USDT, USDC, BNB, AVAX, TRON, and others, while cold wallets stayed intact and user balances are being covered by Bitgets protection fund. Reports show the attackers have been moving funds through multiple DeFi protocols, including THORChain, Chainflip, Uniswap, 1inch Fusion, Stargate, Across, and Relay, converting large XRP positions into BTC and then peeling it across many addresses as part of laundering flows.

2. The DEX Neutrality Debate Around THORChain

Bitget CEO Gracy Chen publicly urged THORChain to refuse service to known attacker addresses, arguing that decentralization is a design principle, not a shield for facilitating known stolen funds. Thorchains official response expressed sympathy for victims but emphasized that it is a decentralized, permissionless protocol, analogizing its role to Bitcoin or Ethereum when they process stolen funds. Critics counter that Thorchain has previously used an internal red button to halt operations after its own exploits, proving intervention is possible, and SlowMists cofounder Cosine reproached Thorchain for declining to act here while still earning fees on hacker flows. At the same time, centralized issuers like Circle and Tether have already frozen portions of the stolen stablecoins, highlighting the sharp difference between controllable assets and neutral routing infrastructure.

3. Governance, Regulation, And What To Watch

This episode forces a hard question: should cross-chain DEXes act more like regulated financial intermediaries or continue to behave as neutral transport layers. If protocols start blocking certain addresses at the base layer, they risk undermining censorship resistance and composability, but if they do nothing, they invite political and regulatory pressure, especially when hacks are linked to state actors and the sums run into hundreds of millions. Expect more experimentation at the edges, such as front-end address screening, optional safety modes, and increased reliance on asset issuers and exchanges to freeze and trace funds, while core protocols fight to remain credibly neutral.

Conclusion

The Bitget hack and the ensuing fight over THORChains responsibilities highlight a central tension in crypto: neutral, permissionless infrastructure versus real-world demands for intervention when large, public hacks occur. How this debate evolves will shape both future DEX designs and the level of regulatory scrutiny applied to cross-chain liquidity protocols.