The Bitget hack has turned into crypto's ugliest fight about who polices stolen money. THORChain has formally refused the exchange's plea to block wallets tied to the $387.5 million breach, even as the attacker keeps swapping stolen Ether for Bitcoin through the protocol.
Bitget CEO Grace Chen asked THORChain on Sept. 26 to "refuse service" to publicly flagged attacker addresses: "Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching." About $6 million in ETH has already been converted to BTC through the network, Blockonomi reported.
Related reading: Bitget hacker cashes out via Binance as exchange posts 5% bounty; Bitget hacker moves $83M in XRP that Ripple can't freeze.
Permissionless means permissionless
THORChain says network halts exist only to protect the protocol itself and "are not a selective freeze of specific funds or an individual swap." It compares itself to Bitcoin, Ethereum and BNB Chain, asking what duty those networks bear when stolen coins pass through. "THORChain is permissionless and doesn't censor by design," the team posted on X.
Critics call that selective memory. BNB Chain validators did halt their network after a $600 million hack in 2022, trapping most of the loot. And THORChain itself paused trading in May after losing $10.7 million from its own pools, Protos reported. GoPlus Security added that THORChain validators demonstrably can pause chains and outflows, unlike Bitcoin or Ethereum miners.
The Bybit precedent
This is a rerun. After the 2025 Bybit hack, attackers linked to North Korea's TraderTraitor operation laundered the bulk of $1.5 billion in stolen Ether through THORChain, generating $2.91 billion in volume and about $3 million in fees, even under FBI pressure. A core developer known as Pluto quit when node operators rejected a block.
The Bitget trail looks familiar: Arkham-flagged wallets with Lazarus Group links sweeping ETH for BTC while the protocol processed $678 million in two days, versus $20 to $60 million on a normal day.
Withdrawals reopen on schedule
While the fight rages, Bitget is executing its recovery plan. Bitcoin withdrawals resumed Monday across Bitcoin and BNB Smart Chain after the wallet flaw was remediated, with ETH set for Tuesday, USDT for Wednesday and remaining tokens plus P2P on Friday. The exchange moved 2,042 BTC (about $169 million) from its 5,500 BTC protection fund to hot wallets in advance, GNcrypto reported.
Cold wallets were never touched, and Bitget says no user gets priority access, from VIPs to employees.
What to watch
- Validator votes: any THORChain governance move to pause the ETH chain would split the community
- Tuesday's ETH reopen: the real stress test, with hacker funds still circling the same rails
- Exchange screens: flagged BTC leaving THORChain for centralized venues is where freezes bite
- Bybit's ghost: regulators took notes in 2025; a second mega-laundering may force their hand