THORChain Tells Bitget It Will Not Block the Attacker's Addresses

THORChain said on Monday that it will not block the wallets holding funds taken from Bitget, four days after the exchange lost $387.5 million. Bitget's chief executive had asked publicly over the weekend for the protocol to refuse service to the listed addresses. The answer was that a halt is not a selective freeze. While the two sides argued, swaps kept clearing. CoinDesk counted 27 of them between 03:55 and 06:23 UTC on Monday.

The ask, and the answer

Gracy Chen, who runs Bitget, made the request in public. "We are formally asking @THORChain to refuse service to these addresses," she wrote, in a message quoted by Unchained. She paired it with an argument about where decentralization stops. It is "a design principle, not a shield for facilitating known stolen funds," she said, adding that the industry was watching. The Crypto Times carries both sentences; the others carry only the first.

THORChain answered in public the same morning.

"A halt is not a selective freeze of specific funds or an individual swap. THORChain is permissionless and doesn't censor by design," the protocol said.

It then put the question back, asking what responsibility Bitcoin, Ethereum and BNB Chain should bear when known stolen funds pass through them. The Crypto Times alone carries that one.

What the protocol says it cannot do

The technical claim is narrow. Emergency controls can stop network-wide activity, on CoinDesk's account, and cannot single out one address without interrupting everyone else. THORChain adds that the attacker's wallets "were never blacklisted and therefore never prevented from swapping," which describes the machinery and does not defend the result. The Crypto Times reports that the admin key was retired in February 2025, that no operator holds blacklist authority and that the validator set signs with a GG20 threshold scheme. One outlet carries all three claims. Neither tier-1 piece confirms them.

Three trackers, three counts

How much has moved through the protocol depends on who is counting. CoinDesk's Monday tally is 2,390 ETH swapped into 75.2 BTC, about $6.3 million, across 27 completed swaps, with orders arriving in batches of roughly 100 ETH and every payout landing at a single address. Four more swaps, 400 ETH, were pending. GoPlus put the running total near 101.5 BTC, about $8.5 million, in counts carried by Unchained and The Crypto Times. Bitquery counted 126.71 BTC across 66 swaps out of BNB and TRX by 25 September. Those three cover different assets and different windows, no outlet reconciles them against the others, and they do not reconcile here.

Against that, the freezable share looks small. Circle and Tether had locked $318,000 of USDC and USDT as of 26 September, a figure Cryptonomist gives and the others do not. About 27.63 million XRP, near $43 million, had been swapped into bitcoin through the protocol by the same date. CoinDesk reported on 26 September that the attacker moved roughly $83 million of stolen XRP that Ripple cannot freeze, native XRP sitting outside the issuer's freeze controls. Bitget has offered a 5% bounty and set a 28 September restart for withdrawals.

The precedent, and a length nobody agrees on

THORChain has halted before. In May 2026 it stopped trading after $10.7 million was drained from its vaults, a figure all four outlets here give. The length of that halt they do not agree on. CoinDesk says five weeks; The Crypto Times says about 39 days. Five weeks is 35. Neither piece shows its working, and we could not establish which figure is right. Both agree on the part that matters for Monday: the attacker's addresses were never blacklisted then either. Unchained also places the $292 million Kelp exploit of April on the same rails, and that loss is now in front of a Vancouver court.

Bitget has no further mechanism to ask for. The exchange can keep publishing addresses and the trackers can keep counting. The protocol has now said in writing that it holds nothing between a full halt and doing nothing at all. Whether its validators keep to that if the amounts grow is what Monday did not settle.