Cross-Chain DEX Refuses To Freeze Stolen Crypto

TLDR

A major cross-chain DEX, THORChain, refused to block hacker addresses used to launder funds from a large exchange hack, igniting a decentralization versus responsibility debate in crypto.

1. Hackers stole about 387.5 million dollars from Bitget and routed part of the haul through THORChain, which declined Bitgets public request to freeze the wallets.
2. THORChain argues it is a permissionless network like Bitcoin or Ethereum, while critics point to past emergency pauses as evidence it can intervene selectively.
3. For users, the case highlights how hard stolen funds are to recover once they hit cross-chain DEXes and suggests growing regulatory and governance pressure on such protocols.

Deep Dive

1. What Happened In The Bitget And THORChain Case

Bitget suffered a security breach on 24 September in which roughly 387.5 million dollars in crypto was moved to attacker controlled addresses, across XRP, ETH, USDT, USDC and other assets. Reports show that over several hours, attackers converted portions of the haul and sent about 4 to 4.5 million dollars worth through THORChain, swapping into native Bitcoin that was then dispersed across many wallets, complicating recovery efforts.

Bitget CEO Gracy Chen publicly asked THORChain validators to block addresses linked to the hack, stating that decentralization should not be a shield for facilitating known stolen funds. THORChain rejected the request and compared itself to Bitcoin and Ethereum, asking what responsibility base layer networks should bear when processing flagged funds.

Bitget says its user protection fund of about 464 million dollars covers all customer balances, and it has scheduled a phased reopening of withdrawals while cooperating with security firms that track the stolen coins.

2. Decentralization Claims Versus Selective Intervention

THORChain defends its refusal by calling itself a decentralized, permissionless cross chain DEX that cannot censor individual transactions, likening any requested blocklist to asking miners on Bitcoin to halt specific payments. This stance appeals to a strict non censorship interpretation of decentralization.

Critics argue the protocol already has emergency powers. Security researchers and industry figures highlight past incidents where THORChain node operators paused the network or specific functions, including a 2021 exploit, a January 2025 freeze of lending and savings products, and a May 2026 vault drain where the network was halted for hours to protect its own assets.

They also point to the 2025 Bybit hack, where about 1.2 billion dollars in stolen funds allegedly tied to North Koreas Lazarus Group were laundered through THORChain, despite pressure from law enforcement. This history feeds a narrative that the protocol can intervene but chooses not to when third party users are the ones harmed.

3. What This Means For Users And Markets

Once stolen funds reach a cross chain DEX and are converted into native assets like Bitcoin, practical recovery becomes extremely difficult, especially when coins are fragmented across many wallets and chains. Stablecoins like USDC and USDT can sometimes be frozen by their issuers, but decentralized assets generally cannot.

Centralized exchanges can and do freeze suspicious deposits, as Bitget did for some tokens, but they cannot control flows that remain entirely on decentralized rails. This asymmetry makes cross chain protocols attractive laundering routes and raises the likelihood of future regulatory scrutiny on such platforms.

For everyday users, the episode underlines that exchange choice, custody model and protocol governance all affect how losses from a hack may be handled, even if a specific platform promises insurance funds.

Conclusion

THORChains refusal to freeze hacker linked wallets after the Bitget hack crystallizes a broader conflict between permissionless design and expectations of victim protection. Hackers are exploiting cross chain DEXes as high throughput, low friction laundering pipes, while exchanges and regulators push for more intervention. How protocols like THORChain evolve their emergency powers and governance thresholds will shape both user trust and the regulatory climate for decentralized infrastructure.