THORChain, the decentralized cross-chain liquidity protocol, has reportedly declined to intervene and block approximately $387. 5 million in funds connected to the Bitget hack, with those assets reportedly moving toward Bitcoin through the protocol’s swap infrastructure.
THORChain, the decentralized cross-chain liquidity protocol, has reportedly declined to intervene and block approximately $387.5 million in funds connected to the Bitget hack, with those assets reportedly moving toward Bitcoin through the protocol’s swap infrastructure. The reported refusal, based on unconfirmed accounts circulating in the security research community, has renewed scrutiny of whether permissionless infrastructure carries any obligation to act as a compliance checkpoint.
According to unconfirmed reports, THORChain node operators were asked to freeze or blacklist wallet addresses associated with the Bitget exploit. The protocol declined to take that action, allowing the transfers to proceed. THORChain is designed as a permissionless, censorship-resistant protocol, meaning no central authority governs which transactions are processed. That design is a core feature of the network, not an oversight. For related coverage, see Bitcoin Spot ETFs Draw $2.39B in Weekly Net Inflows.
The decision places THORChain at the center of a recurring debate in decentralized finance: whether non-custodial infrastructure bears responsibility when its rails are used to move stolen assets. THORChain has previously halted its own chain in response to exploits targeting the protocol itself, but that involved a direct threat to the network, not funds originating from an external breach.
How the Funds Are Moving Toward Bitcoin
THORChain enables native cross-chain swaps without wrapped tokens or bridges, making it a commonly used route for moving value between chains. In this reported case, funds linked to the Bitget hack appear to have been routed through THORChain’s liquidity pools toward Bitcoin. Independent verification of the specific transaction hashes and wallet addresses had not been confirmed at the time of writing; the $387.5 million figure should be treated as unconfirmed until block explorer data is publicly attributed.
Bitcoin is a predictable destination for large illicit fund movements. Once converted to BTC and moved into self-custody wallets, assets become significantly harder to trace through centralized intermediaries. The Bybit hack saw $1.4 billion stolen, with 77% still trackable on-chain in part because the attackers had not yet completed conversion to harder-to-monitor assets at that stage. The pattern here mirrors that playbook, with Bitcoin serving as the intended exit layer.
Readers seeking to verify the reported on-chain movements can monitor native Bitcoin transaction data through Mempool.space, which provides real-time tracking of unconfirmed and confirmed BTC transactions without requiring account registration.
What THORChain’s Decision Means for Recovery Efforts
THORChain’s reported refusal effectively closes off one intervention point in the recovery chain. Once assets clear a non-custodial swap protocol and arrive in Bitcoin addresses, recourse narrows to exchange-level KYC enforcement if the attacker attempts to off-ramp to fiat, or cooperative action from regulated custodians if the BTC is eventually deposited there.
The incident adds to a pattern of decentralized protocols facing pressure to act as compliance checkpoints, a role their architecture was not built to fill. THORChain’s liquidity base has already contracted under pressure from RUNE’s price decline, and any governance response to this episode could further shape how node operators weigh protocol integrity against external demands.
Security researchers have noted that white-hat intervention has occasionally recovered funds in comparable cases. Galaxy’s analysis of the Coldcard hack wave found that 40% of a second tranche was linked to white-hat actors, suggesting that even without protocol-level blocking, coordinated community response can alter outcomes. Whether a similar effort materializes here depends on how quickly blockchain analysts can map the reported wallet cluster.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
