Bitget formally asks THORChain to refuse service to attacker addresses

Bitget CEO Gracy Chen has gone public with the exchange’s request for THORChain to halt transactions linked to the exploit that drained about $387.5 million from its wallets. 

As Cryptopolitan reported, Circle and Tether already intervened, stopping nearly $318,000 in stablecoin movement related to the hack on Friday, September 25. However, the request to the no-KYC THORChain DEX is not expected to be as straightforward.

THORChain offers fast and permissionless native cross-chain swaps with no know-your-customer checks for legitimate users. However, that same feature makes it popular among bad actors looking to move funds out of recovery range.

Notably, THORChain did not freeze transactions after its own $10.7 million vault exploit earlier this year.

Bitget’s CEO wants THORChain to stop exploiters’ fund movement

Chen wrote on X early Saturday, “We are formally asking @THORChain to refuse service to these addresses.”  

The Bitget executive warned the exchange that “the industry is watching” as it challenged it not to use “a design principle” such as protocol neutrality or decentralization to absolve itself of any responsibility while “known stolen funds” moved through its platform. 

How THORChain can intervene is not as straightforward as earlier Cryptopolitan reporting has noted that THORChain is more synonymous with code than an actual company. 

The DEX runs on 95 globally distributed nodes with no admin key and no controlling multisig, according to the protocol’s own account. 

What happened to Bitget? 

Bitget suffered a September 24 breach that resulted in the theft of $387.5 million, up from an initial $351.6 million estimate, according to a September 25 support-center update. 

The haul included AVAX, BNB, ETH, TRX, USDT, USDC, XRP, and ZEC, parked at primary receiving wallets, including 0x770b…63ee for Ethereum-side assets. Separate addresses hold XRP, Zcash, and TRON assets. 

Bitegt has set up a live tracing dashboard and an attacker-address API to monitor the attackers in real-time.

According to Bitget, cybersecurity firms Mandiant and SlowMist are assisting the investigation of the incident it claims is already contained. The exchange also ruled out any possibilities of further unauthorized transfers. 

Why THORChain is the pressure point

The reason Chen is pointing at THORChain is its track record. TRM Labs described the protocol in May as “the bridge of choice” for laundering North Korea’s largest heists, citing the roughly $1.5 billion Bybit hack in February 2025 and the nearly $300 million KelpDAO theft. TRM also noted that THORChain “has consistently refused to block illicit activity,” casting that refusal as an anti-censorship stance.

MistTrack also called out the pattern on September 25, citing how nearly $1.2 billion of the Bybit loot moved through THORChain. 

What Bitget is doing to recover funds

Beyond the public plea, Bitget has launched a Recovery Bounty Program that pays 5% of any funds frozen and 5% of any recovered, routed in part through Bybit’s LazarusBounty channel. 

The exchange said some assets have already been frozen with help from industry partners, though actions taken under court orders or law-enforcement requests are excluded from the bounty.

Chen also said Bitget will restart withdrawals in phases, warning that the process is slower than usual because the incident touches multiple blockchains and multiple tokens. 

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.