THORChain declines Bitget request to block addresses tied to $387.5 million hack
Bitget asked THORChain to refuse service to addresses holding its stolen funds; THORChain says a network halt is not a selective freeze and it does not censor by design.
Read this event in 日本語, русский, português (Brasil), Türkçe
Why it matters
Bitget is trying to freeze addresses through a protocol it cannot compel, and THORChain rejected the request four months after its own validators halted the network over an exploit that Crypto.News put at $10.7 million and Protos put at $10 million. Bitget has offered a 5 percent bounty for freezing or recovering the funds, and the exchange question of whether a permissionless network can be expected to screen individual addresses is unresolved.
Where the sources disagree
Attribution of the Bitget attack
highly consistent with known patterns of North Korean hacker organizations
Protos
using techniques consistent with North Korea-linked hackers
Unchained
Bitget has not publicly confirmed that North Korean actors carried out its September attack
Crypto.News
Bitget's CEO tied the attack to North Korean patterns, while Crypto.News states Bitget has not publicly confirmed North Korean actors.
Total value Bitget says was taken
approximately $387.5 million transferred to attacker-controlled addresses
Bitcoin.com News, Bitcoin.com News, Crypto.News, Unchained, CoinDesk, CryptoPotato
over $380 million lost
Protos
2,377 attacker addresses holding $378 million
Crypto News (CryptoNews.net)
Bitget's disclosure and the reported value of its public tracker do not match.
Size of THORChain's own May exploit
approximately $10.7 million drained from one vault
Crypto.News
hacked for $10 million
Protos
Sources describing THORChain's May halt give different amounts drained from the vault.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (following hack)
$387.5 million
Bitcoin.com News
$600 million
Protos
Bitcoin.com News reports $387.5 million, Protos reports $600 million (35% apart).
amount taken
$387.5 million
Crypto.News
$600 million
Protos
Crypto.News reports $387.5 million, Protos reports $600 million (35% apart).
amount taken (hack)
$387.5 million
Unchained
$600 million
Protos
Unchained reports $387.5 million, Protos reports $600 million (35% apart).
amount taken
$600 million
Protos
$387.5 million
CoinDesk
Protos reports $600 million, CoinDesk reports $387.5 million (35% apart).
Key facts
Bitget initially said hackers stole around $351 million, while CryptoPotato reported the earlier estimate as $351.6 million.
Disputed figureReported by Bitcoin.com News
Bitget says attackers broke into a backend wallet system on Sept. 24 and got the exchange's own approval process to sign the transfers, rather than stealing a private key.
Reported by Unchained
Bitget CEO Gracy Chen formally asked THORChain on Sept. 26 to refuse service to the publicly identified attacker addresses.
Reported by Bitcoin.com News
THORChain said a halt is not a selective freeze of specific funds or an individual swap, and that it is permissionless and does not censor by design.
Reported by Unchained
CoinDesk found 27 successful swaps in which about 2,390 ETH, worth $6.3 million, were exchanged for 75.2 BTC, with all bitcoin payouts going to one address, and four additional swaps involving 400 ETH marked pending.
2,390 ETHReported by CoinDesk
GoPlus Security claims around 101.5 BTC linked to the incident had already exited through THORChain, with another 27.63 million XRP being routed toward Bitcoin.
101.5 BTCReported by Crypto.News
THORChain halted its network in May after an exploit drained a vault, an amount Crypto.News puts at approximately $10.7 million and Protos at $10 million.
Disputed figureReported by Crypto.News
What happened
Bitget says hackers moved about $387.5 million out of the exchange on Sept. 24 after compromising a backend wallet system and getting its own approval process to sign the transfers; the exchange first put the loss near $351 million, which CryptoPotato reported as $351.6 million, and Protos described the breach as a $352 million hack. CEO Gracy Chen asked THORChain on Sept. 26 to refuse service to the publicly identified attacker addresses, saying decentralization is a design principle and not a shield for facilitating known stolen funds. THORChain declined, saying it is permissionless and does not censor by design, that a halt is not a selective freeze of specific funds or an individual swap, and that it is decentralized and permissionless like Bitcoin, Ethereum and BNB Chain. CoinDesk traced 27 successful swaps submitted between about 03:55 and 06:23 UTC on Monday, in which roughly 2,390 ETH worth $6.3 million became 75.2 BTC at a single address, with four further swaps covering 400 ETH marked pending. GoPlus Security claims about 101.5 BTC linked to the theft had already exited the protocol and that 27.63 million XRP was being routed toward Bitcoin, and MistTrack says nearly $1.2 billion from the 2025 Bybit hack was traced through the network; Bitget has not confirmed either figure, and its public tracker, as reported by Crypto News, lists 2,377 attacker addresses holding $378 million with 1,497 of them marked as having moved funds through THORChain. Bitget has not publicly confirmed that North Korean actors carried out the September attack, though Chen described the techniques as consistent with North Korean hackers, and the exchange says it is tracing stolen assets with security firms while restoring withdrawals.
How the story developed
- Update
Bitget discloses a breach of its backend wallet system
The exchange says attackers used its own approval process to sign transfers of roughly $387.5 million.
- Update
Bitget raises its loss estimate to $387.5 million
CryptoPotato reported the figure was revised up from an initial $351.6 million after Zcash and Tron assets were added.
- Official statement
Gracy Chen asks THORChain to refuse service to the attacker's addresses
Chen said the addresses are public and being tracked, and that decentralization is a design principle, not a shield for known stolen funds.
- First report
First report by Bitcoin.com News
Bitget CEO Wants Thorchain to Block Hackers, but There’s a Catch
- Official statement
THORChain rejects the request and GoPlus challenges its decentralization claim
THORChain compared itself to Bitcoin, Ethereum and BNB Chain; GoPlus Security said on Sept. 27 that validator-controlled vaults and emergency controls make the comparison misleading.
- Independent corroboration
Independently corroborated by Crypto.News
THORChain decentralization challenged over DPRK flows
- Update
THORChain clarifies that a halt is not a selective freeze, as CoinDesk traces Monday's swaps
CoinDesk found 27 successful swaps turning about 2,390 ETH into 75.2 BTC at a single address, with 400 ETH in pending swaps.
- Update
Bitget's public tracker lists 2,377 attacker addresses
Crypto News reported that 1,497 of the listed addresses are marked as having moved funds through THORChain.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 26 Sept 2026, 20:16 UTC: Bitcoin.com News, official — 1 independent source, 1 reports
- 27 Sept 2026, 11:48 UTC: Crypto.News — 2 independent sources, 2 reports
- 28 Sept 2026, 10:17 UTC: Unchained — 3 independent sources, 5 reports
- 28 Sept 2026, 12:08 UTC: Protos — 4 independent sources, 6 reports
- 28 Sept 2026, 12:13 UTC: CoinDesk — 5 independent sources, 7 reports
- 28 Sept 2026, 22:17 UTC: CryptoPotato — 6 independent sources, 9 reports
Affected entities
Also mentioned: OKX, XRP, Tether USDt, Circle, Base, Binance, USD Coin
Original sources
Related events
North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
Blockchain investigator ZachXBT attributes a $2.84 million BNB Chain theft to North Korea-linked group SquidSquad, tracing funds through Tornado Cash to Tron wallets tied to prior North Korean addresses.
Bitget Raises September Hack Loss Estimate to $387.5 Million After Adding Zcash and TRON Transfers
Bitget raised its estimate of assets moved to attacker-controlled addresses in the September 24 breach to $387.5 million, about 83.5% of its protection fund.
Bitget resumes bitcoin withdrawals four days after $387.5 million breach
Bitget reopened bitcoin withdrawals at 08:00 UTC on Sep. 28 after a Sep. 24 breach that moved about $387.5 million to attacker-controlled addresses.
Duelbits Confirms About $7M Hot Wallet Drain Across Four Blockchains, Site Offline
Duelbits confirmed a roughly $7M hot wallet hack on Thursday, pulled its site offline and says user funds are safe while blockchain trackers dispute the amount stolen.
NOWPayments Publishes Enterprise Payout Data Comparing TRON, BNB Smart Chain, Solana
NOWPayments published payout data for TRON, BNB Smart Chain, Solana, Bitcoin and Ethereum, putting TRON first on value moved and BNB Smart Chain first on transfer count.
Binance Wallet Adds USDT Gas Payments on BNB Chain, Ethereum, Solana and TRON
Binance Wallet now lets users pay gas fees in USDT on BNB Smart Chain, Ethereum, Solana and TRON instead of holding each chain's native token.