DeFi debate flares over hacked fund flows

TLDR

A huge Bitget exchange hack and routing of stolen assets through THORChain has triggered a sharp argument over whether DeFi should block known hacker flows.

1. Hackers stole about $387.5 million from Bitget and moved part of it through THORChain into Bitcoin, prompting Bitget to demand address blocks that THORChain refused.
2. THORChain cites its permissionless design, while critics point to past emergency pauses and North Korea linked flows as evidence it could intervene but chooses not to.
3. The outcome will shape how future DeFi protocols balance censorship resistance with regulatory pressure, especially around cross chain swaps and compliance layers.

Confidence: high because multiple independent reports concur on the hack details and the public dispute.

Deep Dive

1. Hack And Fund Routing

Reports say Bitget suffered a security breach on 24 September, with roughly $387.5 million in crypto moved to attacker controlled wallets across several networks including Ethereum, XRP, Zcash, BNB Chain, TRON and Avalanche. Bitget later detailed how the attackers exploited a third party security product to steal internal credentials and inject forged withdrawals, while cold wallets remained intact.

Blockchain trackers describe how attackers swapped frozen risk assets like USDT and USDC into ETH and BNB, then pushed roughly 4 to 4.5 million dollars through THORChain, converting to native Bitcoin that was dispersed across thousands of wallets, making recovery harder. Circle and Tether were still able to freeze around 318 thousand dollars of stablecoins, showing the contrast between centralized issuers and permissionless routing on THORChain.

2. Responsibility Vs Decentralization

Bitget CEO Gracy Chen publicly asked THORChain to refuse service to clearly flagged attacker addresses, arguing that decentralization should not shield facilitation of known stolen funds, as outlined in coverage of the dispute. THORChain replied that it is a decentralized, permissionless network similar in spirit to Bitcoin and Ethereum, and questioned what responsibility base chains bear when processing stolen assets.

Critics including security firm GoPlus and exchange leaders note that THORChain previously halted its own network after a May 2026 exploit that drained about 10.7 million dollars, and after prior incidents in 2021 and 2025. They also highlight that over one billion dollars from the Bybit hack attributed to North Korea was laundered through THORChain, arguing that the protocol has tools to act but limits them to protecting its own solvency.

3. What Comes Next For DeFi

Bitget says a 464 million dollar protection fund will cover users, and it is gradually reopening withdrawals as investigations continue and bounties are offered for freezing or recovering stolen assets. That limits direct user losses but does not resolve how future cross chain hacks will be handled.

For THORChain and similar protocols, the pressure is likely to focus on governance tools, clearer criteria for emergency halts and possible optional compliance layers, especially when funds are tied to sanctioned entities or large centralized hacks. Regulators and law enforcement already urge bridges and DeFi services to block designated addresses, so any change in THORChains stance could set a precedent that other DeFi projects either follow or explicitly reject.

Conclusion

The Bitget hack has turned THORChains permissionless architecture into a test case for DeFis ethical and regulatory responsibilities around hacked fund flows. How protocols and regulators resolve this tension between censorship resistance and victim protection will influence the design of cross chain infrastructure and the practical risk profile of using decentralized rails alongside centralized exchanges.