Thorchain under pressure after Bitget hack as Bybit row returns
Bitget's CEO asked Thorchain to block wallets tied to a $387.5 million hack. Thorchain refused, and crypto figures are split over whether a decentralised protocol should intervene.
Key points
- Hackers stole $387.5 million from Bitget on Sept. 24, according to Bitcoin.com News.
- Bitget CEO Gracy Chen publicly asked Thorchain to deny service to attacker-linked addresses.
- Thorchain said its protocol is decentralised and permissionless, comparing itself to Bitcoin and Ethereum.
- OKX founder Star Xu said Thorchain's validator model is not true decentralisation, citing a 13-hour network pause in May.
- Thorchain previously moved an estimated $1.2 billion linked to the 2025 Bybit hack and did not block those swaps.
Bitget suffered a hack on Sept. 24 in which attackers took $387.5 million from the exchange, and the fallout has pulled Thorchain into a public argument about decentralisation. Bitcoin.com News reported that the attacker has used several routes to move the stolen funds, with Thorchain among the services used. Bitget CEO Gracy Chen posted on X and tagged Thorchain's account, asking the platform to block the attacker's wallets.
Thorchain expressed sympathy over the Bitget hack but said its protocol is decentralised and permissionless, in the same way as Bitcoin, Ethereum and BNB Chain. Its X account then asked what responsibility those networks bear in the matter. The exchange's request has divided crypto commentators, with some backing Chen and others rejecting the idea that a protocol should censor transactions.
Joel Valenzuela, business development and marketing lead at Dashpay, replied to Chen's post and called the request unfair. He said nobody asks Bitcoin or Ethereum to reverse transactions, though he noted both have rolled back their chains in the past, with Ethereum doing so explicitly to undo an exploit.
Bitget asks for a block
Star Xu, founder and CEO of OKX, took the opposite view. He argued that Thorchain's TSS and validator model does not represent true decentralisation, because a selected set of validators controls the assets in the TSS vaults and can move funds once the signing threshold is reached. He said that from a custody perspective Thorchain is not comparable to the base-layer consensus of Bitcoin or Ethereum, and acts as an intermediary between users and the native chains.
Xu and Valenzuela then traded replies. Valenzuela said there is no central authority and no censorship mechanism, and told Xu to stop complaining because his centralised model cannot protect users. Xu called that false and pointed to May, when Thorchain's own vaults were drained, saying node operators paused the whole network within minutes and kept it offline for 13 hours. He argued a network that can stop when its own funds are at risk, but will not when someone else's are, is not like Bitcoin.
This is not Thorchain's first dispute over stolen funds. In February 2025, after Bybit was hacked, the platform became the main conduit for the North Korean Lazarus Group to move an estimated $1.2 billion, and Thorchain did not block those swaps despite pressure from the FBI. After the Bitget attack, Bybit founder Ben Zhou told Chen that Bybit would be ready to help, saying Bitget had helped Bybit during its own hack and that lazarusbounty.com was being updated to help trace the stolen funds.
Decentralisation claims disputed
Some observers accept Thorchain's argument that a genuinely decentralised protocol should not be expected to censor transactions, just as bitcoin miners would not. But according to some commentators, the May pause on its own vaults weakens the claim that it cannot intervene, and looks like selective morality.