Bitget asks Thorchain to block hackers after $387.5m breach
Bitget chief executive Gracy Chen has publicly urged Thorchain to refuse service to attackers who moved stolen funds through the network, after the exchange raised its loss estimate to $387.5 million.
Key points
- Bitget now puts the damage from this week's hack at approximately $387.5 million, up from an earlier estimate of about $351 million.
- CEO Gracy Chen asked Thorchain on Saturday to refuse service to the attacker's publicly listed addresses.
- Reports say tens of millions in XRP were deposited into Thorchain vaults, with another stash swapped for BTC and moved across bitcoin addresses.
- Thorchain declined a similar request from the FBI after the Bybit hack, when $1.2 billion to $1.5 billion in stolen funds moved through the protocol.
- Thorchain replied that it is decentralized and permissionless, comparing itself to Bitcoin, Ethereum and BNB Chain.
Bitget has raised its estimate of losses from this week's hack to approximately $387.5 million, up from the roughly $351 million it first reported, according to Bitcoin.com News. The exchange says the funds were transferred to attacker-controlled addresses. Two days after the breach, chief executive Gracy Chen publicly asked Thorchain to cut off the hackers as they moved the stolen money.
Thorchain is a decentralized network that lets users swap crypto assets across different blockchains, such as exchanging BTC for ETH. This weekend, several reports said tens of millions in XRP were deposited into Thorchain vaults, while another stash of tens of millions was already swapped for BTC. The bitcoin is then peeled and hopped across many bitcoin addresses, Bitcoin.com News reported.
The attackers are reportedly using other rails as well, including Chainflip, Uniswap, 1inch Fusion, Stargate, Across and Relay. The Thorchain activity drew the attention of Bitget executives, and Chen took to X on Saturday to ask the protocol to block the attackers. She wrote that the attacker addresses are publicly listed and actively tracked, and that the exchange was formally asking Thorchain to refuse service to them. She added that decentralization is a design principle rather than a shield for facilitating known stolen funds, and that the industry is watching.
Loss estimate rises
Her request did not sit well with some people replying to the thread. One respondent asked what part of permissionless she did not understand, and why she was not asking BTC miners to stop the funds. Another compared the situation to blaming a highway used by a bank robber to escape.
Chen's ask echoes a standoff Thorchain already faced after the Bybit hack, when it was used to move $1.2 billion to $1.5 billion in stolen funds. The FBI asked the industry to block DPRK-linked addresses, and three validators voted to halt ETH trading. Four validators reversed that decision about half an hour later, and Thorchain continued to run. A developer quit over the episode, according to the report.
The protocol does have the technical ability to halt the entire system, and nodes can pause trading. After the May 2026 GG20 exploit drained about $10.7 million to $11 million from one of its vaults, operators paused the network and it stayed down for weeks while they patched. Some Thorchain front ends have screened sanctioned or flagged addresses for years, but this can be bypassed. Bitcoin.com News noted that if Thorchain could not block the Bybit funds, or validators chose not to, it likely will not happen in this case either.
Thorchain's role in laundering
At 2:17 p.m. Eastern time on Saturday, Thorchain's official X account replied to the request and tagged the Bitget CEO. It said it was devastated to hear about the exploit and could imagine how difficult this must be for everyone involved. It added that Thorchain is decentralized and permissionless like Bitcoin, Ethereum and BNB Chain, and asked what responsibility those chains should bear when handling known stolen funds.