Bitget’s Hack Forces THORChain to Confront Transaction Filtering
Bitget CEO Gracy Chen has asked THORChain to reject transactions from addresses linked to the exchange's September 24 exploit.
- Bitget has asked THORChain to reject transactions from publicly flagged exploiter addresses.
- Bitquery traced 37 THORChain swaps involving stolen BNB, while additional stolen TRX was routed toward BTC.
- Blocking addresses would require an enforcement point inside a protocol whose swaps depend on distributed nodes rather than a centralized compliance account.
The request sounds straightforward. Implementing it on a permissionless cross-chain protocol is not.
MistTrack, SlowMist’s on-chain tracking platform, says funds associated with the Bitget attacker have entered THORChain for asset swaps and cross-chain transfers. Independent tracing by Bitquery and TRM Labs has also identified routes moving stolen BNB and TRX toward Bitcoin through cross-chain infrastructure.
THORChain and Stolen Funds: The Industry Needs Answers
After the $1.46B @Bybit_Official hack last year, nearly $1.2B in stolen funds was reportedly traced through @THORChain as the attackers moved assets across chains.
Today, following another major security incident at @Bitget…
— MistTrack🕵️ (@MistTrack_io) September 25, 2026
For THORChain, the issue is now technical as much as philosophical: where would an address blacklist actually be enforced in a network designed without a central transaction gatekeeper?
$10.6 Million Has Already Reached Cross-Chain Routes
Bitquery’s investigation provides one of the clearest public views of the fund movements.
Its September 25 snapshot traced 126.71 BTC, worth approximately $10.6 million, paid out through routes involving THORChain and Chainflip.
For stolen BNB, researchers identified 37 completed THORChain swaps producing 51.26 BTC. Another traced route converted stolen TRX into 48.05 BTC through THORChain.
TRM Labs separately traced approximately $9.8 million in stolen BNB through exploiter-controlled addresses, with portions ultimately routed through THORChain and converted into Bitcoin.
Those figures represent traced routes, not the entire Bitget loss. Bitget has since put the total value transferred to attacker-controlled addresses at approximately $387.5 million.
Why THORChain Cannot Freeze Funds Like Tether
The distinction starts with who controls the asset.
Tether and Circle issue USDT and USDC through smart contracts containing administrative capabilities that allow addresses to be blacklisted under certain circumstances. After the Bitget exploit, the issuers froze approximately $318,000 in stablecoins associated with one hacker wallet.
Native assets work differently.
Bitcoin and the native assets of networks such as Ethereum do not have a stablecoin issuer sitting above them with an equivalent contract-level blacklist function.
READ MORE: Hester Peirce Exits SEC With Major Crypto Rules Still Unfinished
THORChain adds another layer. It is designed to facilitate swaps between native assets on separate blockchains through a decentralized network of nodes and liquidity rather than maintaining customer accounts like a centralized exchange.
There is therefore no Bitget-style compliance department that can simply suspend an attacker’s THORChain account. The protocol would need some mechanism capable of recognizing flagged addresses and preventing associated transactions from being processed.
Whether THORChain should introduce or use such a mechanism is precisely what Chen’s request has put under scrutiny.
Address Filtering Creates a Second Problem: Who Maintains the List?
Even if transaction filtering were technically introduced, another problem appears immediately.
Someone has to decide which addresses qualify.
The Bitget exploiter addresses are publicly flagged and are being tracked by blockchain security firms, according to MistTrack. But crypto stolen in large exploits rarely remains at one address. Assets can move through chains of intermediary wallets, exchanges, bridges and swaps.
A blacklist therefore raises questions beyond the original hacker wallet.
How far should transaction history be followed? Who determines when an address is sufficiently connected to stolen funds? How quickly should an address be removed if incorrectly flagged?
Centralized exchanges already make these decisions through internal compliance systems.
A permissionless protocol adopting similar controls would need its own answer to the same problem.
Bybit Shows Why THORChain Is Facing the Question Again
The Bitget flows follow a much larger precedent.
After the $1.46 billion Bybit exploit in 2025, substantial amounts of stolen crypto were converted through THORChain as attackers moved assets across networks.
MistTrack says nearly $1.2 billion associated with that exploit was routed through THORChain.
The protocol’s activity surged as the laundering operation progressed, bringing an uncomfortable consequence of permissionless liquidity into view: the same infrastructure that allows ordinary users to exchange native assets without a centralized intermediary can remain available to addresses linked to major thefts.
Bitget has now brought that issue back less abstractly by explicitly requesting transaction rejection.
The Regulatory Question Is Different From the Technical One
Chen’s request does not itself establish that THORChain has a legal obligation to block the addresses.
It does, however, sharpen a question likely to matter beyond this hack: how regulators treat decentralized infrastructure when operators know that publicly identified stolen assets are passing through it.
The answer depends heavily on architecture, control and jurisdiction. A protocol, its software developers, node operators and liquidity providers do not automatically carry the same legal obligations as a centralized exchange or stablecoin issuer.
Those distinctions are important, particularly before drawing conclusions about sanctions or liability.
For now, Bitget’s case exposes the practical boundary.
Investigators can identify addresses. Stablecoin issuers can freeze some assets. Centralized exchanges can block accounts. Blockchain analysts can continue following funds after they move.
THORChain is being asked to do something different: turn knowledge about an address into a reason for the protocol not to process it.
Whether that can happen without materially changing how permissionless cross-chain liquidity works is now the more consequential question.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
