DeFi protocols face scrutiny over stolen funds

TLDR

A string of recent hacks and laundering incidents has put DeFi infrastructure under sharp scrutiny for how it handles stolen crypto funds.

1. Centralized exchange hacks, especially Bitgets $387.5 million breach and routing of funds through THORChain, are driving a public dispute over protocol responsibility for flagged hacker wallets.
2. The tension centers on permissionless DeFi design versus real-world intervention powers, as stablecoin issuers freeze funds while cross-chain protocols resist blacklisting individual addresses.
3. For users, this scrutiny means more regulatory and governance pressure on bridges, L2s, and cross-chain protocols, and a greater need to assess security and incident response before using them.

Deep Dive

1. Recent Hacks And Laundering Routes

Bitget reported unauthorized transfers of roughly $387.5 million across networks including Ethereum, XRP Ledger, Zcash, BNB Chain, Avalanche, TRON and others, with some of the assets later moving into Bitcoin via THORChains cross-chain swaps. Bitget initially estimated $351.6 million in losses before revising the figure after further tracing of Zcash and TRON transactions, and is now working with firms such as Mandiant and SlowMist to recover funds and offer bounties for freezes and recoveries, while gradually reopening withdrawals for major assets like BTC and ETH.

Tracking firms and security researchers note that only a small portion of Bitgets stolen assets has been converted through THORChain so far, but the incident echoes earlier laundering of more than $1 billion in stolen Bybit funds on the same protocol that researchers and the FBI linked to North Korean actors.

At the same time, other DeFi-related incidents are adding pressure. Scammers launched a fake Ethereum Layer 2 chain impersonating Giwa, draining about 766 ETH, over $2 million, from more than 1,300 users who bridged through a multichain DEX before the real Giwa clarified that its mainnet was not live. Separate attacks on Payy Network, Duelbits and Meter Network recently cost over $11 million combined, targeting bridges, private keys and consensus logic.

2. Decentralization Versus Intervention

Bitgets CEO publicly asked THORChain validators to block attacker addresses, arguing that decentralization should not shield known stolen funds. THORChain refused, stating that its permissionless design does not allow selective censorship and likening the request to asking Bitcoin or Ethereum validators to stop processing specific transactions.

Critics point out that THORChains architecture includes validator-controlled threshold-signature vaults and documented emergency pause mechanisms. The protocol has previously halted its network or vaults after exploits, including a May incident where around $10.7 million was drained from a vault, suggesting it can intervene when its own solvency is at risk even if it will not blacklist third-party hacker wallets.

In contrast, centralized actors embedded in DeFi flows, such as stablecoin issuers, have demonstrated more direct controls. In the Bitget case, Circle and Tether froze roughly $318,000 in USDC and USDT tied to attacker addresses, illustrating a split between immutable, neutral settlement layers and assets or protocols with embedded compliance levers.

3. Implications For DeFi Users And Market Structure

Regulators and security firms already highlight DeFi bridges, cross-chain routers and L2 endpoints as high-risk infrastructure because they concentrate flows and can be used to obscure the origin of stolen funds. Incidents like Bitgets breach, the fake Giwa L2 and recurring bridge attacks reinforce that narrative and could lead to tighter expectations on incident response, blacklisting policies or even mandatory integration with sanctions lists for some protocols.

For individual users, the practical impact is a higher premium on due diligence. That includes verifying whether a chain or bridge is the official deployment, understanding a protocols history of halts and exploit responses, and recognizing that some assets, such as major stablecoins, can be frozen even when the underlying chain cannot.

Conclusion

Scrutiny over stolen funds is forcing DeFi protocols and exchanges to confront the gap between cypherpunk-style neutrality and the real-world demand to act on publicly known hacker wallets. Large hacks and sophisticated scams are accelerating calls for clearer responsibilities, and the outcome will shape how permissionless infrastructure coexists with compliance and law enforcement pressure. For DeFi users, security, governance and incident response now matter as much as fees and yield when choosing where to move capital.