DEX Defies Freeze Requests On $387.5M Hack

TLDR

THORChain (RUNE) is refusing to block hacker-linked wallets after the $387.5 million Bitget exchange breach, exposing a major fault line between DEX design and freeze demands.

1. Bitget was hacked for about $387.5 million, and its CEO publicly asked THORChain validators to block known attacker addresses, a request the protocol has rejected as incompatible with permissionless design.
2. Cross-chain swaps through THORChain are being used to convert stolen assets into Bitcoin, reviving criticism that validator-controlled DEXes can both pause for their own safety and still facilitate laundering of stolen funds.
3. Users should watch how Bitgets recovery, future regulator guidance, and THORChain governance debates reshape expectations around security, frozen funds, and what decentralized really means for cross-chain liquidity.

Deep Dive

1. Bitget Hack And DEX Response

On 24 Sep, Bitget reported a breach affecting about $387.5 million in assets across Ethereum, XRP Ledger, TRON, Zcash and other networks, later updating its loss estimate as tracing improved. Independent on-chain analyses show attackers routing part of the haul via THORChain to swap into native Bitcoin, with tracking firms estimating roughly $4 million to $4.5 million has moved through the protocol so far.

Bitget CEO Gracy Chen published the attacker wallet list and formally asked THORChain to refuse service to these addresses, arguing that decentralization should not shield facilitation of known stolen funds as described in several reports, including a detailed coinpedia summary. THORChain responded that it is a permissionless network similar to Bitcoin or Ethereum and posed the question of what responsibility such base-layer systems bear when processing stolen assets.

2. Decentralization Versus Responsibility

The refusal has triggered a wider argument over whether THORChains architecture is truly analogous to Bitcoin or Ethereum. Critics highlight that THORChain validators collectively control threshold-signature vaults and have previously paused the network in emergencies, including a 2024 validator exploit and prior incidents, suggesting the protocol can intervene when it chooses, as noted in analysis of its emergency controls.

This history matters because THORChain was already in the spotlight after the 2025 Bybit hack, where roughly $1.2 billion in funds tied to the Lazarus Group reportedly moved through its pools. The Bitget episode revives concerns that a protocol willing to halt when its own vaults are drained, but not when third-party customers are robbed, is operating closer to an intermediary than a neutral base layer.

3. Risks And What To Watch

For Bitget users, the immediate risk is operational rather than on-chain: the exchange says a protection fund of around $464 million will cover customers and has scheduled phased withdrawal restarts, beginning with Bitcoin and then other assets, according to notices referenced in recent coverage of the hack and recovery plan. Native assets like XRP and BTC cannot be frozen at the protocol level, so recovery relies on cooperation from exchanges, stablecoin issuers and investigative firms to blacklist and intercept flows where possible.

Regulatory and reputational risk now centers on THORChain and similar services. Security firms and some founders are openly questioning whether FBI or sanctions listings should trigger network-level emergency actions, while THORChains own documentation still frames pauses around protocol safety rather than external theft. Future guidance could push DEXes toward clearer policies on flagged wallets, or reinforce the current use at your own risk model for permissionless swaps.

Conclusion

The Bitget hack shows how quickly stolen funds can traverse multiple networks and hide behind cross-chain liquidity, while also testing how far decentralized protocols will go to help victims. For crypto users, the key takeaway is that custody choices, exchange protections and the governance powers of any DEX or bridge you rely on are as important as yield or convenience, especially when large thefts occur.