THORChain Rejects Bitget’s Request to Stop Attacker: Why?
THORChain said it rejected a request to block addresses linked to the Bitget attacker, explaining that its existing emergency shutdown tools would also disrupt other users’ transactions.
As Bitget pursues the stolen funds following the approximately $388 million attack, a dispute over intervention has emerged between the exchange and THORChain, a cross-chain swap network. Bitget CEO Gracy Chen emphasized over the weekend that the attacker’s addresses were public and asked the network not to serve them.
In a statement reported by CoinDesk, Chen argued that decentralization should not shield the movement of known stolen funds. THORChain said, however, that rather than blacklisting specific addresses, it uses emergency shutdown mechanisms to protect the protocol.
Why doesn’t THORChain block only the attacker?
The network’s operators have tools that can halt swaps across all connected blockchains or restrict activity on a specific network, such as Ethereum. But such an intervention would also stop transactions by other investors using the same routes.
This distinction is central to THORChain’s response: shutting down the network to protect the protocol is not a selective action aimed at freezing one wallet’s funds or rejecting a single swap. The network is not implementing the address-based blocking Bitget requested.
About $6.3 million in Ethereum converted to Bitcoin
While the request was under discussion, swap orders were sent to THORChain from an Ethereum wallet that Lookonchain linked to the attacker’s activity. Based on an examination of public records, about 2,390 ETH was converted into 75.2 BTC across 27 successful swaps, totaling approximately $6.3 million. All of the Bitcoin payments went to a single address.
The records reviewed cover orders sent between 06:55 and 09:23 Turkey Time on September 28. Four additional swaps containing a total of 400 ETH were pending when the records were examined.
It had halted the network during its own attack
When about $10.7 million was stolen from its own vaults in May, THORChain halted the network. Transactions resumed about five weeks later, on June 22. The team said that attacker addresses were not blacklisted in that incident either; the intervention was made to protect the compromised protocol.
Bitget is offering a 5% reward to anyone who helps freeze or recover the stolen funds under suitable conditions.