THORChain Will Not Freeze Stolen Bitget Ether Bound for Bitcoin

A wallet tied to the Bitget hack converted 2,390 ETH into 75.2 bitcoin through THORChain on September 28 after the protocol refused to block the addresses. The batch was worth about $6.3 million. It ran while Bitget chief executive Gracy Chen was still asking the network to cut those wallets off.

THORChain said a full halt exists to protect the protocol, not to freeze one thief. That is the same class of emergency control it used in May, when its own vaults were drained.

The Wallet That Turned Ether Into Bitcoin

On-chain records of THORChain swaps show 27 completed trades from about 03:55 to 06:23 UTC on September 28, a window of 2 hours and 28 minutes. Lookonchain, the blockchain tracker, had already tagged the sending wallet as part of the attacker’s activity. Every bitcoin payout went to one address.

Most orders were about 100 ETH, valued at about $265,000 a batch at the prices used in that review. Four more swaps, totaling 400 ETH, were still pending when the records were pulled. Price floors on the route left some 100 ETH orders only partly filled, and about 114 ETH came back to the sending wallet.

MONDAY’S THORCHAIN BATCH

• Completed swaps: 27 trades converted 2,390 ETH into 75.2 BTC, all paid to one bitcoin address.
• Dollar value: About $6.3 million of ether moved in that sitting, in lots of roughly 100 ETH.
• Clock: Orders ran from 03:55 to 06:23 UTC on September 28.
• Friction: About 114 ETH returned after minimum-price limits stopped two of the 100 ETH orders from filling in full.

That Monday run was not the first time stolen Bitget coins used the same rail. Bitquery, which indexes the chains involved, matched 37 THORChain swaps that had already paid 51.26 BTC for stolen BNB by 14:05 UTC on September 25, with more bitcoin coming out of TRX routes the same day.

Why THORChain Will Not Freeze Those Addresses

Chen made the ask on September 26, after Bitget published attacker addresses and stood up a recovery bounty. “Our attacker addresses are publicly listed and actively tracked. We are formally asking THORChain to refuse service to these addresses,” she wrote on X.

Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching.

Gracy Chen, Bitget chief executive, on X

THORChain answered that a network halt is an emergency security mechanism designed to protect the protocol. Operators can pause swaps across the whole network, or throttle a connected chain, but those controls also stop honest traffic on the same routes.

A halt is not a selective freeze of specific funds or an individual swap. During the May 2026 exploit that resulted in $10.7M stolen from the liquidity pools, the attackers addresses were never blacklisted and therefore never prevented from swapping on THORChain. THORChain is permissionless and doesn’t censor by design.

THORChain, official account, on X

A THORChain network halt is an emergency security mechanism designed to protect the protocol.

A halt is not a selective freeze of specific funds or an individual swap.

During the May 2026 exploit that resulted in $10.7M stolen from the liquidity pools, the attackers addresses… https://t.co/HrigTUbA4Q

— THORChain (@THORChain) September 28, 2026

The protocol compared itself to Bitcoin, Ethereum, and BNB Chain and asked what duty those networks would bear when stolen coins pass through them. Star Xu, the founder of OKX, rejected the analogy, writing that threshold signatures still leave an intermediary in place even when control is split. “TSS distributes control among multiple parties, but distributing an intermediary does not eliminate the intermediary,” he wrote.

GoPlus Security warned node operators not to put the industry at risk for the fee line, after estimating that bitcoin and XRP from the theft were already moving through the protocol. THORChain pointed instead to Michael Perklin, the former ShapeShift CISO, who argued that tools stay neutral and that unplugging machines to stop crime would also stop legal swaps. The published attacker list is also behind the money: new hop wallets keep appearing after each notice, so a freeze aimed at last week’s addresses would miss this week’s.

The Protocol Halted Itself for 39 Days in May

The gap in THORChain’s answer is not that it lacks a kill switch. It used one on itself. On May 15, a newly churned node operator abused a flaw in the GG20 threshold signature scheme, rebuilt a vault key, and drained about $10.7 million from one Asgard vault. Automated solvency checks stopped trading, and node operators then paused the network.

Swaps, signing, and liquidity-provider actions stayed down for 39 days while vaults were checked and funds moved to new ones. Trading came back on June 23. THORChain is right that it never blacklisted that attacker’s addresses. It is also true that the halt existed, was used, and cost every honest user weeks of downtime when the protocol, not an outside exchange, was the victim.

FROM THE BITGET DRAIN TO THE REFUSAL

1. May 15, 2026: An Asgard vault on THORChain is drained for about $10.7 million; trading halts.
2. June 23, 2026: THORChain restores swaps, signing, and liquidity-provider actions after 39 days offline.
3. September 24, 2026: Bitget hot and warm wallets begin paying an attacker at 18:31 UTC; the last outflow Bitquery timed left at 21:23 UTC, 2 hours and 52 minutes later.
4. September 25, 2026: Bitget raises the loss to $387.5 million and posts a 5% freeze bounty and a 5% recovery bounty; stolen BNB is already swapping for bitcoin on THORChain.
5. September 26, 2026: Chen formally asks THORChain to refuse service to the listed addresses.
6. September 28, 2026: THORChain says a halt is not a freeze; a linked wallet completes 27 ETH-to-BTC swaps.

A shutdown that stops every swap to catch one flow is the only tool the protocol says it has. That is why the May pause does not settle Chen’s request, and why the request still lands as a demand that THORChain behave like a bank.

NEAR Intents Turned the Same Traffic Away

Another cross-chain venue made the opposite choice the same week. Alex Shevchenko, general manager of NEAR Intents, said its SHIELD system flagged more than $50 million in attempted transfers tied to the Bitget attacker, froze $503,000 while those trades were executing, and still saw about $166,000 pass through. The protocol said it would skip Bitget’s bounty so more of any return could go back to the exchange. Chen publicly thanked the team.

Illia Polosukhin, a NEAR co-founder, replied directly on THORChain’s refusal thread and told the project to implement SHIELD and decline to serve funds that are clearly stolen. He framed those declines as small emergency halts per transaction. Permissionless design did not, in that view, require a blank welcome mat.

WHO STOPPED THE FLOW, AND WHO DID NOT

The contrast is mechanical. A venue that can see an intent before it settles can refuse the job. A venue that only signs an already-formed swap, and that treats any refusal as censorship, will keep paying bitcoin to the next address on the list.

How Much of the Stolen Haul Still Sits Untouched

Bitget’s written incident update says approximately $387.5 million were transferred to attacker-controlled addresses, up from a first count of $351.6 million after Zcash and TRON transfers from the same window were added. The exchange says that revision is not a second breach. Confirmed assets include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX. Independent cybersecurity firms Mandiant and SlowMist are on the investigation.

The first unauthorized transfers left at 18:31 UTC on September 24. Bitquery counted 21 transfers on eight chains and found test sends of 93 TRX and 0.84 ETH before the large bursts, including five chains paid in 15 seconds at 19:01 UTC. Chen later said the attacker used a flaw in a third-party security product to obtain high-level internal credentials, then fed fraudulent withdrawal commands into wallet backend services. Private keys were not stolen, Bitget says, and cold wallets were not touched. Traces of the commands were deleted, which Chen called the trickiest part.

Scorechain mapped 28 attacker-controlled addresses across eight networks within hours and attributed the cluster to North Korea’s Lazarus Group, which the U.S. Treasury designated Lazarus Group in 2019. Chen has been more careful in public, saying some IP addresses matched VPN infrastructure used by a DPRK group and that the pattern looked familiar, while holding a formal incident report for later.

As of 07:00 UTC on September 28, Bitquery still had 48,923 ETH still sitting in six wallets that had never sent a transaction, about 33% of the loss. All of the stolen XRP had left its first accounts, and 90.5% of it had been swapped for bitcoin. By 14:38 UTC on September 25, 126.71 BTC, about $10.5 million, had already been paid for stolen BNB and TRX across THORChain and Chainflip. That earlier bitcoin pile is a separate batch from the 75.2 BTC that came out of the Monday ETH swaps.

Circle and Tether Froze What Had Not Yet Moved

Stablecoin issuers can blacklist a wallet. The attacker treated that as a clock, not a theory. Bitquery’s trace shows stolen USDT passed on within eight minutes of landing and had been sold for ETH within twenty minutes; USDC and the gold token XAUt followed within about half an hour. Tether still froze 239,113 USDT in two attacker wallets by September 25. Anything already swapped into ether sat outside that lever.

Bitget’s recovery program pays 5% of funds that are frozen through eligible voluntary work and another 5% of funds that are actually recovered. Court orders and law-enforcement seizures do not qualify. The exchange also opened a live fund tracing dashboard and an address API for other firms to screen against. NEAR Intents said it would not claim the bounty. THORChain did not join the freeze list at all.

BOUNTY TERMS BITGET PUT ON THE TABLE

• Freeze share: 5% of affected funds successfully frozen by eligible voluntary work.
• Recovery share: 5% of affected funds successfully recovered by eligible voluntary work.
• Excluded: Actions taken under court orders, law-enforcement requests, or other legal process.

A bounty priced for good-faith partners does not reach a protocol that has already defined wallet-level refusal as censorship. Bitcoin paid out on THORChain also does not come with an issuer freeze button. Once the ether is bitcoin at a fresh address, the next fight is at the off-ramp, not at the swap.

Bitget’s Protection Fund Absorbs the Loss

Chen has said customer balances were not written down and that the User Protection Fund, more than $464 million, covers the shortfall. She told a September 28 livestream the fund will be refilled to at least $300 million within a week from corporate reserves, and that platform funds exceeded $1.4 billion on an August 31 audit. “An incident like this scale is very serious,” she said. “But serious doesn’t mean existential.”

Bitcoin withdrawals on the Bitcoin network and BNB Chain reopened at 08:00 UTC on September 28, after each chain passed extra checks. Ethereum withdrawals on Ethereum, BSC, Arbitrum, Base, and Optimism were set for 08:00 UTC on September 29. USDT on Ethereum, BSC, Solana, and Tron was due September 30, with remaining assets, fiat, and peer-to-peer transfers listed for October 2.

Users of the exchange are, on that account, made whole from a reserve that predates this breach. The coins themselves are still moving. Six Ethereum wallets that have never sent a transaction still held 48,923 ETH as of the morning of September 28, and the wallet Lookonchain flagged had already shown how those coins leave: in 100 ETH lots, through a swap network that will not name a thief.

Disclaimer: This article is news reporting and analysis of a cryptocurrency theft, on-chain tracing, and a protocol policy dispute. It is informational only and is not investment advice, trading advice, legal advice, or a recommendation to buy, sell, hold, or use any token, exchange, or cross-chain service. Readers who hold assets on an exchange or in a self-custody wallet, or who are considering a claim, freeze request, or recovery bounty, should consult a qualified lawyer and a licensed financial adviser before acting. Figures, wallet balances, freeze status, and withdrawal schedules reflect the company statements, on-chain investigations, and public posts cited here as of the dates given in the piece and can change as funds move and as Bitget’s incident report is published.