DEX Defies Freeze Requests On $387.5M Hack

TLDR

THORChain (RUNE) is refusing to block hacker-linked wallets after the $387.5 million Bitget exchange hack, keeping swaps permissionless despite calls to freeze stolen funds.

1. Hackers routed part of the stolen Bitget funds through THORChain to Bitcoin, while Bitget and partners froze only limited stablecoins.
2. THORChain publicly rejected Bitgets freeze request, citing decentralization, even though it has paused its own network in past exploits.
3. The clash highlights a growing security and regulatory debate around cross-chain DEXes, with users facing higher recovery and compliance risk.

Confidence: high, based on multiple independent news and analysis reports.

Deep Dive

1. What Happened In The Bitget Hack

Bitget reported that about $387.5 million in crypto was moved to attacker-controlled addresses in a September 24 breach, revising an earlier $351.6 million estimate after including Zcash and TRON assets in its tally.Bitget theft update

Stolen assets included XRP, ETH, USDT, USDC, BNB, Avalanche, TRX and others across Ethereum, the XRP Ledger, TRON and EVM chains.Bitget multi-chain loss

Tracking firms report that attackers funneled part of the funds into THORChain, swapping into native BTC and dispersing coins across many wallets, making freezing or recovery extremely difficult.THORChain laundering route

Bitget and stablecoin issuers managed to freeze roughly $318,000 in USDT and USDC, a small fraction of the total.Stablecoin issuer freezes

2. THORChains Refusal And Selective Intervention Debate

Bitget CEO Gracy Chen publicly urged THORChain validators to block addresses linked to the hack, arguing that decentralization should not be a shield for facilitating known stolen funds.Chens freeze appeal

THORChain rejected the request, saying it is a permissionless protocol comparable to Bitcoin, Ethereum and BNB Chain and asked what responsibility such networks should bear when handling known stolen funds.THORChains response

Critics point out that THORChain has emergency controls and has paused its own network after vault drains, including a roughly $10.7 million validator exploit and earlier DEX incidents, showing it can intervene when its own assets are at risk.Network pause history

The same protocol reportedly processed about $1.2 billion of stolen Bybit funds in 2025 linked to North Korean actors without blocking swaps, which is now being contrasted with Bitgets case.Bybit flows through THORChain

3. User Impact And What To Watch Next

Bitget says its user protection fund, over $464 million, will cover losses and that customer balances remain intact; withdrawals are resuming in stages from September 28 to October 2 across BTC, ETH, USDT and other assets.Bitget recovery plan

For users, the main risk is that cross-chain DEX routing plus mixing tools like CoinJoin make stolen coins harder to trace, which can increase scrutiny on addresses interacting with those ecosystems and complicate compliance.Mixing and tracing challenges

Despite the controversy, THORChains RUNE token reportedly rose more than 20 percent over 24 hours, suggesting some market participants are prioritizing narrative of censorship resistance over concerns about protocol responsibility.RUNE price reaction

Regulatory and security firms are now debating whether protocols with explicit pause and governance tools should be expected to act when law-enforcement or major exchanges flag specific flows.Governance pressure

Conclusion

The Bitget hack and THORChains refusal to freeze hacker-linked wallets spotlight a core tension in crypto between uncompromising permissionless design and practical responsibilities around stolen funds.

For users and builders, the episode is a reminder that once assets leave centralized venues and move through cross-chain DEXes into native coins, recovery becomes extremely hard, while regulatory and reputational risks for the protocols themselves are likely to rise.