THORChain is facing renewed scrutiny over its handling of stolen funds following the September 24 Bitget exploit. The exchange confirmed that $387.5 million was taken by attackers, initially reported as $351.6 million before Zcash and Tron assets were added to the tally. Bitget attributed the breach to a backend system vulnerability in its wallet setup rather than a compromised private key.
On September 26, Bitget CEO Gracy Chen formally requested that THORChain refuse service to addresses linked to the theft. "Decentralization is a design principle, not a shield for facilitating known stolen funds," Chen stated. According to Bitget's public tracker, 1,497 of the 2,377 attacker addresses have moved funds through THORChain swaps.
THORChain responded by asserting that it operates as a decentralized and permissionless protocol, comparable to Bitcoin, Ethereum, and BNB Chain, and questioned what responsibility those networks would bear under similar circumstances.
The Censorship Resistance Question
The dispute has widened into a debate over whether screening transactions constitutes censorship. Security researcher Taylor Monahan argued that screening stolen assets differs meaningfully from halting a network, while crypto commentator Joel Valenzuela countered that halts and rollbacks have occurred on most networks, including Bitcoin, and that transaction screening represents actual censorship.
Critics also pointed to THORChain's own network halt in May following a $10.7 million exploit. Validators paused the network within hours, and trading and withdrawals remained unavailable for approximately five weeks until June 22. Observers questioned the apparent contradiction in a protocol that can halt operations for its own losses while declining to block known stolen assets.
Recovery Efforts Underway
Bitget has offered 5% bounties on frozen and recovered funds. The exchange thanked Circle and Tether for quickly freezing approximately $318,000 linked to the hack. Bitget restarted withdrawals in phases, beginning with Bitcoin on September 28 at 08:00 UTC.
