Bitget has formally asked THORChain to refuse service to addresses tied to a $387.5 million exploit, and the protocol says it does not censor by design and has no per-address blacklist to block them with.
Bitget CEO Gracy Chen said in a post on X on Sept. 26 that the exchange’s attacker addresses are publicly listed and actively tracked, and that she is formally asking THORChain to refuse service to them. “Decentralization is a design principle, not a shield for facilitating known stolen funds,” she wrote.
THORChain said in its own post on X that a network halt is an emergency security mechanism, not a selective freeze of specific funds or an individual swap. “THORChain is permissionless and doesn’t censor by design,” the post said. During its own May 2026 exploit, which took $10.7 million from liquidity pools, attacker addresses were never blacklisted and were never prevented from swapping.
The technical gap behind that answer, as crypto author Anndy Lian described in a post on X, is that THORChain has no built-in per-address blacklist. Blocking the Bitget funds would require halting all swaps on the affected chains, which would cut off every user, or shipping a code upgrade with address filtering and getting two-thirds of nodes to adopt it. The tools the protocol does have, like pausing trading or an outbound chain, are blunt and need only a few node votes, and THORChain has used them before, including during its May exploit.
Meanwhile the attacker is using the protocol as designed. Lookonchain reported Monday, citing Arkham data, that ETH linked to the attacker is flowing into THORChain vaults and being swapped for Bitcoin.
The dispute frames a real question for the industry: whether permissionless infrastructure should be asked, or forced, to police stolen funds. Chen has made her position public; THORChain’s design makes targeted refusal deliberately hard. Whether Bitget’s demand has any enforcement path beyond the public ask is not known.
Bitget confirmed in its announcement that BTC withdrawals resumed at 08:00 UTC on Sept. 28, the first step in its phased restoration after the Sept. 24 breach, with ETH withdrawals scheduled to return Tuesday and USDT on Wednesday.
