Top DEX Defies Requests On $387.5M Hack

TLDR

Bitget was hacked for about $387.5 million, and THORChain, a leading cross chain DEX, is refusing to block the hackers wallets, arguing it must stay permissionless and decentralized.

1. Hackers drained roughly $387.5 million from Bitget and began routing part of the haul through THORChain to convert assets into Bitcoin.
2. Bitgets CEO publicly asked THORChain to block known hacker addresses, but THORChain declined, comparing itself to Bitcoin and Ethereum and saying it cannot censor transactions.
3. The clash highlights growing tension between code is law DeFi and demands from exchanges, security firms, and regulators to intervene when stolen funds use permissionless rails.

Deep Dive

1. Scale Of The Hack And Use Of THORChain

Bitget has updated its estimate of the breach to about $387.5 million in crypto moved to attacker controlled addresses across Ethereum, XRP Ledger, TRON, Zcash and other networks, up from an initial $351.6 million figure as more assets were accounted for. Reports note that large amounts of XRP and other tokens were traced moving through wallets after the attack as Bitget and forensic firms worked to follow the funds.

To obfuscate and launder part of the haul, hackers have been using THORChain to swap stolen tokens into native Bitcoin, a pattern similar to flows seen after the 2025 Bybit hack where about $1.2 billion in stolen funds reportedly passed through THORChain. Once assets become native BTC, there is no issuer that can freeze them, which is exactly why Bitget and security firms are alarmed.

2. THORChains Refusal And Decentralization Debate

Bitget CEO Gracy Chen publicly asked THORChain to refuse service to the attackers wallets, arguing that decentralization is a design principle, not a shield for facilitating known stolen funds, as covered in this summary of THORChains response to Bitgets request. THORChains team pushed back, saying the protocol is permissionless and no different from Bitcoin, Ethereum, and BNB Chain, and asked what responsibility those base layers bear when handling stolen funds.

Critics point out that THORChain has previously paused its network or specific functions after its own vaults were exploited, including a roughly 10.7 million incident, suggesting it does have emergency controls even while claiming it cannot censor transactions. Security firms and some exchange founders argue this is selective intervention, while others defend THORChain as correctly resisting ad hoc blacklists that could erode decentralization and set difficult precedents.

3. User Risks And What To Watch

For everyday users, the primary immediate risk is on centralized exchanges like Bitget, where a single infrastructure breach can compromise hundreds of millions of dollars even without private keys being stolen. Bitget says its user protection fund of around $464 million will fully cover customer balances and is resuming withdrawals in phases, while also offering a bounty for help freezing or recovering funds.

On the DeFi side, the episode underscores how permissionless cross chain liquidity can be used for laundering and how protocol level governance and emergency tools will increasingly sit under regulatory and public scrutiny. Watch for three things: Bitgets actual recovery progress, any future on chain governance debates at THORChain about when to use its pause mechanisms, and whether regulators start treating some DEX infrastructure more like intermediaries when they show the ability to intervene.

Conclusion

The Bitget hack and THORChains refusal to block hacker wallets have turned one exploit into a wider stress test of cryptos decentralization norms. Centralized venues are expected to protect user funds and cooperate in recovery, while permissionless protocols are under pressure to decide whether and when to use their own emergency levers. How this clash is resolved will shape future expectations for both exchanges and DEXs when stolen assets inevitably move across chains.