Bitget Asks THORChain to Block Hacker Address, Protocol Says No

The Bitget hack has sparked a new debate over crypto’s biggest promise of decentralization. After hackers routed stolen funds through THORChain and converted assets into Bitcoin, Bitget CEO Gracy Chen asked the protocol to block the attacker addresses. 

THORChain rejected the request, saying its permissionless design does not allow it to censor transactions.

How Did the Bitget Hacker Use THORChain?

Following the 24 September 2026 Bitget breach, blockchain security firms TRM Labs and SlowMist’s MistTrack tracked how the stolen funds moved across different networks.

According to blockchain tracking firms, the hackers first swapped stolen USDT and USDC into ETH and BNB to avoid freezes by issuers such as Tether and Circle.

Yet, Circle and Tether managed to freeze 218,023 USDT and 99,990 USDC, worth about $318,000 combined, from an attacker linked address.

Over the next 13 hours, the attackers moved millions of dollars in ETH and BNB through THORChain, a cross-chain protocol that allows direct swaps between different blockchains without using wrapped tokens. This allowed hackers to convert part of the stolen funds into native Bitcoin (BTC).

The newly converted BTC was then spread across thousands of private wallets, making the funds harder to track and recover.