THORChain says it can halt the network but won’t freeze the Bitget hacker

THORChain has come out to defend itself with a clarification that the emergency halt it initiated after its May 2026 $10.6 million exploit is not the same thing as the Bitget intervention request to prevent attackers from moving part of the $387.5 million stolen from the exchange through its platform. 

The response is the latest episode in a standoff triggered by the year’s largest crypto hack after Bitget CEO Gracy Chen went public on September 26 with a formal request that THORChain refuse service to the publicly tracked attacker wallets, as Cryptopolitan reported. 

Attackers used the same THORChain route after the Bybit hack, which was, ironically, also the largest security breach of 2025. 

THORChain: A halt is not a freeze

THORChain defended its decision not to go through with Bitget’s request by directing attention to important context it claims is being missed. 

A network halt is “an emergency security mechanism designed to protect the protocol,” according to THORChain, and “is not a selective freeze of specific funds or an individual swap.” 

The DEX clarified that during the May 2026 incident, in which it lost $10.7 million to hackers, it initiated a protocol-wide shutdown to contain the incident. Even then, it did not consider blacklisting the attacker’s addresses, and it would not do it now.

Security firms poke holes at THORChain’s defense 

GoPlus Security pushed back against THORChain’s defense comparing itself with base layers like Bitcoin and Ethereum, posting on September 27 that the protocol “has never been strictly decentralized” and telling it not to “enable criminals — or put the industry at risk — just to take swap fees on stolen funds.” 

The blockchain security firm highlighted distinctions between THORChain’s threshold signature vaults and those of Bitcoin and Ethereum. 

Longtime crypto security executive and THORChain supporter, Michael Perklin, backed up THORChain, calling out “AI slop” suspicion in the GoPlus comparison he considered “cherry picking at best, a false equivalency at worst.” 

Perklin argued that threshold signing is an automated process, not a series of human approvals on individual transfers.

“In all 3, there is no active choice to sign, only an active choice to turn off the machine,” he wrote, comparing a THORChain node operator’s options to a Bitcoin miner or Ethereum validator powering down. 

Shutting the infrastructure to stop criminal transactions, he argued, would stop legitimate ones at the same time. THORChain itself made a similar case, questioning what responsibility Bitcoin, Ethereum, and BNB Chain should bear when they process transactions touching known stolen assets.

Bitget is already moving on with a compensation plan

The dispute plays out against an active recovery effort. Bitget suffered its breach on September 24, with the loss later revised up from $351.6 million to $388 million after transfers on Zcash and TRON were counted. 

Fortune reported that Chen suspects North Korean attackers exploited a backend system to make fraudulent withdrawals look legitimate, without stealing private keys. The exchange’s investigation found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials.

As of this report, Chen stated that Bitget had processed 9,585 BTC withdrawals across the Bitcoin and BSC networks, totaling approximately 4,098 BTC after BTC withdrawals resumed on September 28.

ETH withdrawals are scheduled to resume on September 29, USDT withdrawals on September 30, and other supported tokens, fiat and P2P services on October 2.

Bitget says cybersecurity firms Mandiant and SlowMist are assisting, and it has launched a recovery-bounty program paying up to 5% for funds frozen or recovered, plus a live dashboard to track attacker wallets. 

The exchange also points to its Protection Fund of 5,500 BTC, worth roughly $464 million, though the hack would consume a large share of it.