THORChain Faces Scrutiny Over Bitget as Ethereum’s Role Expands

Cross-chain custody and censorship resistance collided with a high-profile breach narrative this week after Bitget publicly urged the decentralized liquidity protocol THORChain to block addresses allegedly tied to stolen funds. The dispute has reignited questions about what “decentralization” requires—and what it does not—when theft victims point to on-chain activity they believe is known to be malicious.

The push began after Bitget reported unauthorized transfers that it later revised upward, with the exchange attributing the suspected actor to North Korea based on preliminary investigative signals. In response, THORChain’s stance—whether it can meaningfully blacklist the relevant addresses, and whether it should—has become the center of an argument that is now spilling beyond technical governance and into the broader ethics of permissionless networks.

Key takeaways

• Bitget said unauthorized transfers rose from $351.6 million to $387.5 million, and later pointed to IP clues it believes link the activity to VPN infrastructure used by a North Korean hacking group.
• Bitget CEO Gracy Chen publicly asked THORChain to block addresses tied to the alleged theft connected to the Bybit-linked flow on THORChain.
• THORChain’s compliance position is unclear in practice because its ability to blacklist specific addresses has been questioned, including references to earlier admin-key changes.
• The debate is also exposing an asymmetry: decentralized funds may still be traceable after swaps, but protocols differ in whether they can or should exert address-level controls.
• While governance and security principles are at stake, THORChain has also faced criticism of its operational decentralization compared with networks like Bitcoin and Ethereum.

Bitget’s breach claims and the “block the addresses” demand

Bitget disclosed that it had detected “unauthorized transfers” tied to a security incident on September 25. According to Cointelegraph reporting, the exchange initially put the figure at $351.6 million, before updating it to $387.5 million. Bitget also stated that a preliminary investigation had linked IP addresses involved in the incident to VPN services associated with North Korean hacking operations, though the evidence was described as suggestive rather than definitive.

Bitget CEO Gracy Chen publicly argued that decentralized protocols should not serve as a destination for funds connected to theft. She said decentralization is a design principle, not a shield for facilitating known stolen assets, and urged THORChain to block addresses it believed were tied to the incident.

That framing matters because it reframes a typical “hack victim versus exchange” story into a “hack victim versus liquidity routing” story. If a stolen-flow path crosses a decentralized exchange-like venue, the conversation shifts from incident response alone to the network-level question of whether platforms can limit interaction with suspected addresses.

Why THORChain is at the center of the argument

As Bitget’s criticism spread, the broader context involved a prior major breach attributed to North Korean actors: the Bybit hack, reported by Cointelegraph as a $1.5 billion incident. Cointelegraph coverage also noted that funds from that attack were reportedly swapped on THORChain.

THORChain has often been described as a decentralized liquidity mechanism rather than a privacy mixer, and the general claim in the surrounding debate is that funds are still traceable after being swapped. That traceability is crucial: it gives victims and investigators a basis for arguing that specific on-chain participants should be restricted, even if the destination is a decentralized protocol.

However, what victims want—address-level blocking—may not align with how THORChain is technically or politically structured. The article notes that THORChain previously paused its chain quickly following its own $10.7 million hack in May. That detail highlights that the protocol can react decisively to security events, even as it faces scrutiny over whether it can selectively censor or restrict particular counterparties.

Can THORChain blacklist, and should it?

Whether THORChain can blacklist addresses is described as unclear in the reporting. The text points to a reference from February 2025, when THORChain said it had retired an admin key that would have provided the power to blacklist certain addresses.

This uncertainty is important for readers because it changes the nature of the request from “should a protocol do this?” to “can the protocol do this at all without undermining its own design?” Even if governance messaging supports compliance, protocol capabilities and key management can set hard boundaries on what is feasible.

Meanwhile, critics of address blocking argue that allowing decentralized protocols to respond to coercive demands would create a censorship precedent. The debate also includes an “ethics versus practicality” tension: victims emphasize harm reduction and reducing stolen-fund liquidity, while decentralization advocates emphasize permissionless access as an anti-tyranny safeguard.

At the same time, the article draws attention to concerns about THORChain’s decentralization level compared with Bitcoin or Ethereum. It cites the idea that THORChain does not match the governance model of the most decentralized networks and references past claims around administrative functionality. Those points are used to argue that the protocol’s permissionless claims may be overstated in practice.

For traders and builders, the operational reality is what matters most: if a protocol cannot enforce address-level exclusions, then users may still be exposed to flows they would rather avoid. If it can enforce them, then the network may face governance attacks, reputation risk, and the possibility of politically motivated address targeting. Either way, the outcome affects how participants assess risk and compliance expectations.

Market reaction and what to watch next

The controversy has not only sparked governance debate; it also appears to have attracted market attention. The article states that THORChain’s native token RUNE surged 50% over a week amid the publicity around the dispute.

Looking ahead, the key question is whether THORChain will clarify what address-level controls it can implement—if any—and what governance process would apply if requests from centralized exchanges are escalated. Readers should also watch how the underlying theft narrative evolves: Bitget’s attribution remains tied to preliminary investigation signals, and the strength of the evidence will influence whether future calls for restrictions gain wider traction.

In parallel, this episode underscores a broader industry challenge: even in decentralized systems, “who can stop stolen funds?” will increasingly depend on technical capabilities, governance choices, and the willingness of markets to treat permissionless routing as either a resilience feature or a liability.