Top DEX Rejects Freeze Requests On Hack

TLDR

THORChain (RUNE), a major cross-chain DEX, is refusing to freeze wallets tied to the recent $387.5 million Bitget hack, sparking a fight over what decentralized really means.

1. Hackers used THORChain to convert stolen Bitget funds into Bitcoin, and the protocol rejected Bitgets public request to block the attacker addresses.
2. Stablecoin issuers and some chains froze portions of the loot, highlighting a stark contrast between permissioned controls and THORChains strict no-censorship stance.
3. The incident is likely to feed regulatory scrutiny and shape future expectations around how DEXes and cross-chain protocols handle clearly flagged stolen funds.

Deep Dive

1. What Happened In The Bitget Hack

Bitget disclosed that about $387.5 million in crypto was diverted to attacker-controlled addresses during a 24 September breach across several networks, including XRP, Ethereum and TRON, and updated its estimate from earlier figures as more chains were counted, with details in Bitgets own summary and independent analysis of stolen XRP movements, such as reported theft totals and XRP flows.

Tracking firms say the attackers first swapped frozen-prone stablecoins like USDT and USDC into ETH and BNB, then used THORChains cross-chain liquidity to convert several million dollars into native BTC that was spread across thousands of wallets, as described in coverage of how hackers used THORChain to route funds.

Bitget CEO Gracy Chen publicly asked THORChain validators to block the hacker addresses, arguing that decentralization should not excuse facilitating known stolen funds. THORChain responded that its design is permissionless and comparable to base-layer networks like Bitcoin and Ethereum, and refused to intervene.

2. Decentralization Versus Responsibility

Stablecoin issuers Circle and Tether froze roughly three hundred thousand dollars in USDC and USDT tied to the attacker, using issuer-level controls that native assets like XRP or BTC do not have. This underlines how centralized levers can sometimes blunt hacks while permissionless systems cannot.

Critics point out that THORChain has previously paused its own network during exploits affecting its vaults, and that it was also a major route for about $1.2 billion of stolen Bybit funds allegedly moved by the Lazarus Group, according to reports on THORChains role in prior hacks and its selective network pauses.

Supporters argue that asking a DEX to freeze specific wallets pushes it toward becoming an intermediary that picks winners and losers, which could undermine censorship resistance and expose it to greater regulatory classification risk.

3. What To Watch Next

Bitget says its user protection fund fully covers customer losses and has published a tracing and bounty program, while planning staged withdrawal restarts for different assets, as outlined in its attack update and recovery timeline.

For THORChain, the debate is shifting from pure tech to governance. Security firms and industry figures are openly questioning whether it can call itself neutral if it has a history of pausing for its own benefit but not for third-party victims.

Regulators and policymakers already focused on crypto security will likely reference this case when thinking about obligations on cross-chain infrastructure and DEXes, especially where known sanctioned or state-linked actors are involved.

Confidence: high because multiple independent outlets and tracing firms report consistent facts about the hack amounts, routing paths and THORChains refusal to freeze.

Conclusion

THORChains decision to reject freeze requests in the Bitget hack crystallizes a core tension in crypto: permissionless protocols enable censorship resistance, but they also make it harder to respond when stolen funds are clearly identified.

How exchanges, regulators and protocol communities resolve that tension will influence not just THORChains future, but the broader expectations placed on bridges, DEXes and other cross-chain systems when the next large hack arrives.