CEX urges DEX to block stolen funds

TLDR

Bitget, a centralized exchange, is publicly urging cross chain DEX THORChain to block addresses linked to its recent 387.5 million dollar hack.

1. Bitget says hackers are routing stolen funds, including large XRP flows, through THORChain and other DEXs, and wants THORChain to deny service to known attacker wallets.
2. THORChain and some DeFi voices argue that a permissionless protocol should not selectively block transactions, exposing a deep rift over responsibility for stolen funds.
3. For users, the key signals will be how DEX governance, law enforcement, and other infrastructure like stablecoin issuers respond, and whether more platforms add blacklist style controls.

Deep Dive

1. What Happened

Bitgets September security incident has been revised to about 387.5 million dollars in losses, with attackers moving funds through multiple decentralized protocols including THORChain, Chainflip, Uniswap, 1inch Fusion, Stargate, Across, and Relay, often swapping XRP into BTC before further dispersal across wallets, according to one detailed report.

Separate coverage shows the hacker has already moved roughly 83 million dollars worth of stolen XRP from initial holding wallets, with about 75 million dollars still sitting in accounts that cannot be frozen at the ledger level, and only exchanges or platforms can restrict those flows, while Circle and Tether have frozen around 320,000 dollars in related stablecoins as a preventive step, as outlined in this XRP focused analysis.

Bitget CEO Gracy Chen has posted on X that attacker addresses are public and being tracked, and has formally asked THORChain to refuse service to them, arguing that decentralization should not be used as a shield for moving clearly identified stolen funds.

2. Decentralization Versus Responsibility

THORChains official response has expressed sympathy but stressed that, like Bitcoin and Ethereum, it is designed as decentralized, permissionless infrastructure, questioning whether base layer protocols should be held responsible for processing tainted funds, as summarized in this industry recap.

Critics note that THORChain has previously used a so called red button capability to pause operations after direct exploits on the protocol, and argue that refusing service to known attacker addresses is technically possible but was not used here, a point raised by security firm SlowMist co founder Cosine in his public critique.

By contrast, centralized exchanges and some token issuers already use blacklists, account freezes, and compliance checks, which can help protect users but reduce censorship resistance compared with fully permissionless systems.

3. What To Watch Next

Bitget says its protection fund will cover user losses and has published a phased schedule to reopen withdrawals for BTC, ETH, stablecoins, and other assets across networks, signaling that user account balances should remain whole despite the breach.

Key forward signals for the ecosystem include whether THORChain governance revisits its intervention policies, whether more front ends or routers add address screening for flagged wallets, and how aggressively law enforcement and major exchanges coordinate to blacklist attacker flows at the venue level.

Security industry reactions, such as SlowMists criticism of protocols that keep collecting fees while processing stolen funds, suggest rising pressure for some middle ground between strict permissionlessness and basic consumer protection.

Conclusion

This dispute between a centralized exchange seeking to block stolen funds and a decentralized protocol insisting on neutrality highlights a core trade off in crypto between censorship resistance and user protection. For everyday users, the practical takeaway is that recovery and blocking of stolen assets still hinge largely on centralized actors, stablecoin issuers, and venue level controls, while many DEXs and cross chain systems remain structurally neutral to whether funds are hacked or legitimate.