Author: Nancy, PANews
A major attack once again brought the security issues of the encryption industry to the forefront, and also pushed the cross-chain liquidity protocol THORChain to the center of public opinion controversy.
Recently, Bitget suffered a large-scale currency theft attack. Similar to previous large-scale hacking incidents such as FTX, Bybit and Kelp DAO, THORChain has once again become an important channel for cross-chain circulation and exit of stolen funds.
In the face of stolen assets flowing into the protocol, THORChain refused to manually freeze or intercept, claiming to adhere to the principles of decentralization and protocol neutrality, which was very different from its previous approach after being attacked. This also triggered a controversy in the community about the boundary between "protocol neutrality" and "security responsibility."
Decentralization becomes a shield? THORChain falls into doubt about “double standards”
On September 25, Bitget encountered a major security incident. According to Bitget’s latest disclosure, approximately US$387.5 million in assets were transferred to addresses controlled by attackers, making it one of the largest crypto asset thefts since 2026 and quickly affecting the entire industry.
After the incident, Bitget quickly suspended withdrawals and initiated measures such as fund tracking and bounty recovery. It also launched an investigation in conjunction with security agencies such as Mandiant and SlowMist. Many institutions in the industry also quickly expressed their stance and provided support, including Tether, Circle, etc., which froze some of the assets involved. However, compared with the scale of nearly $400 million stolen, the funds that can be directly frozen or recovered are still limited.
At the same time, a large amount of stolen assets entered THORChain after being split. Bitget CEO Gracy Chen later publicly questioned THORChain’s refusal to provide services to the attacker’s address. She believes that decentralization is a design principle but should not be a "shield" when dealing with known stolen funds, and said that "the entire industry is paying attention to this."
However, THORChain did not suspend related transactions. In the face of external doubts, the agreement emphasized that "THORChain, like Bitcoin, Ethereum and BNB Chain, is decentralized and permissionless. So, what responsibilities should these networks bear when dealing with known stolen funds?"
However, THORChain is believed to be using decentralization as a shield. OKX founder Star questioned the degree of decentralization of THORChain. He believes that the TSS and verifier mechanisms adopted by THORChain still play an intermediary role, so they cannot be simply compared to networks such as Bitcoin and Ethereum. At the same time, he also pointed out that when THORChain's own vault encountered risks in May this year, the node operator suspended the network within a few minutes and remained offline for about 13 hours. Since THORChain can suspend the network, it cannot be simply compared to Bitcoin, which cannot be unilaterally stopped.
The incident mentioned by Star is that in May this year, THORChain suffered the theft of approximately US$10.7 million. After the node voting, transactions, signatures, chain observation and node rotation were completely suspended. Cross-chain transactions were resumed after about 39 days of security upgrades, treasury verification and phased restart.
THORChain's "inaction" in the Bitget attack also triggered a "crusade" from some security professionals. SlowMist founder Yu Xian pointed out that the Bitget theft incident was characterized by wide spread, huge amount and clear nature, and financial clues related to North Korean hackers soon emerged. After the incident, Circle, Tether and other institutions quickly took measures to freeze some funds. THORChain was once stolen and intervened in its so-called "decentralization", claiming that it was decentralized and had no right to interfere, and then enjoyed the large cross-chain handling fees contributed by North Korean hackers. Under major industry events, the key is to clearly identify the real problems that need to be solved together.
In response to this, ThorChain’s latest official announcement on September 28 stated that the network interruption when it was previously attacked was an emergency security mechanism designed to protect the security of the protocol. The moratorium is not a selective freeze on specific funds or an individual exchange for individuals. At the same time, the attacker's address has not been blacklisted, so transactions can still be conducted on THORChain.
In fact, this is not the first time that THORChain has been involved in controversy due to similar issues. After Bybit was attacked in 2025, hackers also used THORChain extensively when transferring approximately $1.2 billion in stolen assets. In order to block the transfer of funds, some verification nodes of THORChain voted to suspend ETH transactions, but this decision was quickly overturned by other nodes. Afterwards, Pluto, the chief developer of THORChain, announced his resignation in protest.
At that time, John-Paul Thorbjornsen, founder of THORChain, defended: "Centralized exchanges have made millions from illegal transactions all year round, and they will not stop unless there is regulatory pressure. This set of double standards is disgusting. Do we want ETH and BTC nodes to refund transaction fees? What about those GETH or BTCCore developers who rely on funding and donations to develop underlying software?" He also asked the nodes he controlled to resume trading, and said that if the nodes did not cooperate, the pledge deposits of these nodes would be removed. The relevant comments were subsequently deleted.
It is worth mentioning that when faced with Bybit hacker funds, the cross-chain protocol Chainflip adopted a completely different approach and tried to intercept related funds through protocol upgrades.
Hackers contribute about 10% of revenue, THORChain’s technical limitations and interest game
However, some voices pointed out that the technical reality faced by THORChain makes it difficult to accurately freeze an address like a centralized exchange.
Crypto KOL Anndy Lian pointed out that from a technical point of view, THORChain is not completely incapable of intervention. Through node voting, the protocol can suspend transactions, suspend signatures on external transfers, and even suspend a connected blockchain. According to its mechanism, a single node can suspend transactions for about an hour; adding a few more nodes can extend the suspension time. Such operational parameters only require a few node votes to take effect. However, it is difficult for this protocol to accurately intercept only marked addresses like centralized exchanges, because there is no built-in blacklist mechanism for individual addresses at the protocol level.
dForce founder Mindao further pointed out that even if THORChain takes intervention measures, it will be difficult to directly recover the funds that have been transferred by hackers. In the Bybit and Bitget incidents, hackers controlled a single transaction through THORChain to about $150,000. For hackers, even if Thorchain suspends related services, the maximum potential loss for a single transaction is this level, and they can also turn to other cross-chain routes. For THORChain, it will either maintain an active and constantly updated blacklist forever, or it will stop the chain forever for the more than 100,000 US dollars. And this also involves very complex different pools, such as the LP coordination issues of ETH/RUNE and BTC/RUNE. So from the starting point, this is already a very asymmetric game.
Crypto KOL CM added that THORChain had also chosen to suspend the network when it was attacked before. The main purpose of the suspension at that time was to fix the vulnerability and prevent the same vulnerability from continuing to affect other vaults, rather than to directly recover the assets that had been lost. Therefore, whether THORChain intervenes or not does not have enough influence on the final result.
In addition to technical limitations, economic incentives are also considered to be one of the important reasons for THORChain's reluctance to intervene. In an online poll initiated by KOL Big Orange, more than half of the participants supported ThorChain, believing that “this is what they make.” In the view of these supporters, there is no need for THORChain to accept the so-called "moral kidnapping". Its business model is to provide cross-chain liquidity and asset exchange, rather than acting as a fund review agency to determine whether every asset entering the protocol is legal.
In fact, THORChain has become the main infrastructure for cross-chain transfer of hacker funds in recent years.
According to DeFiLlama statistics, from 2023 to 2026, in 7 confirmed money laundering incidents, THORChain processed approximately US$9.27 billion in abnormal transaction volume, accounting for approximately 8.3% of its historical cumulative DEX transaction volume.
Crypto analyst Chen Jian explained that from Bybit, Kelp DAO to this Bitget incident, hackers frequently choose THORChain, which is related to its unique cross-chain mechanism. Unlike many traditional cross-chain bridge models that lock native assets and issue packaged assets, THORChain completes the exchange between different native assets through a liquidity pool, and uses RUNE as an intermediate asset. For example, after a user transfers ETH to THORChain, the protocol can first convert ETH into RUNE, then convert it into BTC through RUNE, and finally obtain native BTC directly. The transaction histories of the two chains are incompatible with each other and cannot be traced, and KYC is not required at all, making it the first choice for hackers to launder money.
The huge transaction volume brought by hackers also contributed considerable fees to THORChain's nodes and liquidity providers. According to DeFiLlama's disclosure, based on THORChain's 0.1% exchange fee, the protocol and its liquidity providers are estimated to have received approximately US$12.47 million in fee income directly from these illegal fund flows in recent years, accounting for approximately 10.4% of the protocol's historical cumulative fee income. Therefore, the agreement itself is considered from an economic perspective and does not cut off income.
Among them, when the North Korean hacker group Lazarus stole approximately US$1.5 billion from Bybit and laundered funds, THORChain received approximately US$8.63 million in fee income. At that time, the single-day transaction volume reached a record high of US$1.07 billion. After the Bitget incident, according to Blockworks data, on September 26, THORChain achieved approximately US$1.009 million in revenue, a new high since March 2025; the exchange transaction volume on that day exceeded US$460 million, also reaching a high since March 2025.
Not only that, during most hacking incidents, the price of RUNE tokens increased, which means that token holders gained economic benefits.
In the final analysis, what THORChain faces is not just a choice of whether to intercept hacker funds, but a difficult problem that the entire encryption industry cannot avoid: Where is the neutral boundary of decentralized protocols? When agreement principles conflict with real interests, how should we choose?