THORChain rejects Bitget request to block hacker as $6 million moves to bitcoin

Cross-chain swap protocol THORChain has declined a request from crypto exchange Bitget to block addresses connected to a large-scale theft, according to reporting by CoinDesk. The outlet said it identified 27 successful swaps that moved about 2,390 ETH into 75.2 BTC — worth roughly $6 million — even as Bitget urged THORChain to stop serving wallets it has tied to the $387.5 million theft from the exchange.

The episode has revived one of the most persistent disputes in the industry: what, if anything, a decentralized protocol can or should do when its infrastructure is used to move allegedly stolen funds. THORChain is a permissionless liquidity network that lets users swap native assets — such as ether for bitcoin — across different blockchains without relying on a custodian, a wrapped-asset issuer, or a company that processes orders on users' behalf. Trades are settled by a distributed set of independent node operators running open-source software, which means there is no customer-service desk or compliance team with a straightforward ability to press a freeze button the way a centralized exchange can.

That structural difference is why requests like Bitget's are difficult to fulfil. When funds are stolen from a centralized venue, the standard playbook involves notifying other exchanges, stablecoin issuers, custodians and blockchain-analytics firms so that addresses can be flagged and, where the assets are centrally issued, frozen. Stablecoins such as those issued by regulated companies can be blacklisted at the contract level. Native assets like bitcoin cannot: there is no issuer to call, and no administrator key that can claw back coins once they have been sent. That asymmetry helps explain why attackers frequently attempt to convert token holdings into bitcoin, and why the direction of the swaps CoinDesk documented — ether into bitcoin — is a familiar pattern to on-chain investigators.

For THORChain's node operators and community, any intervention would require a protocol-level or governance decision, and such decisions carry trade-offs that supporters and critics weigh very differently. Advocates of credible neutrality argue that a network which can selectively refuse service to specific addresses is no longer meaningfully permissionless, and that the same capability could later be turned against lawful users. Critics counter that protocols which knowingly process funds from major exploits invite regulatory scrutiny, reputational damage and potential liability for the people who build and operate front-ends. Similar arguments have surfaced after previous high-profile exploits, and they remain unresolved across the sector.

It is worth stressing what is and is not established. The figures cited here — 27 swaps, approximately 2,390 ETH converted into 75.2 BTC, and a $387.5 million theft total — come from CoinDesk's reporting and reflect on-chain activity observed at the time of publication. On-chain totals can change quickly as funds continue to move, and attributions of addresses to a specific attacker are typically made by analytics firms rather than confirmed by law enforcement. Readers should treat later figures from exchanges, investigators and the protocol itself as subject to revision.

Broader market conditions have been soft alongside the story. CoinDesk reported bitcoin holding around the $83,000 level in recent sessions, with weakness across parts of the altcoin market. There is no evidence that this incident is driving those moves, and no single event determines future prices.

What to watch next: whether THORChain node operators revisit the question through governance, whether other venues and analytics providers succeed in flagging the converted bitcoin, and whether the standoff prompts renewed policy attention to decentralized cross-chain infrastructure.

This is a news summary for general information only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Always verify against the original source and do your own research before making a financial decision.