THORChain refuses to block Bitget funds, despite pausing after own hack

DeFi project THORChain has turned down a formal plea to “refuse service” to addresses associated with the recent hack of Bitget, a centralized crypto exchange which lost over $380 million on Thursday night.

The decision comes four months after THORChain halted trading after it was hacked for $10 million.

In the aftermath of Thursday’s hack, Bitget CEO Gracy Chen called it “highly consistent with known patterns of North Korean hacker organizations,” after on-chain analysts spotted connections to wallets used following previously attributed hacks.

Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses. Decentralization is a design principle, not a shield for facilitating known stolen funds.
The industry is watching. https://t.co/rOzV9kpu0F

Read more: Bitget’s eighth birthday ends with a $352M hack

Both Chen and blockchain security firm SlowMist, which is supporting Bitget with tracing the stolen funds, appealed to THORChain, with the latter urging that “decentralization should not become a blanket excuse when dealing with known stolen funds.”

Addressing the calls to take action, THORChain said it was “devastated to hear” of Bitget’s hack, but that it is “decentralized and permissionless.”

It compared itself to “Bitcoin, Ethereum, and BNB Chain,” asking if those networks would be expected to halt when stolen funds passed through them.

Notably, following a $600 million hack in 2022, BNB Chain validators did indeed halt the chain, preventing the attacker from extracting the majority of the loot.

We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved.

THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain.

What responsibility should Bitcoin, Ethereum, and BNB Chain bear when… https://t.co/ArvP6N1w3F

Read more: Explained: How $600M was stolen from Binance’s BNB chain

THORChain’s refusal is widely seen as hypocritical considering its validators previously took swift action to halt trading in response to being hacked itself for approximately $10 million back in May.

Revisiting the episode, THORChain has stressed the halt was to protect the protocol, it never selectively blacklisted the hacker, and that it “doesn’t censor by design.”

According to THORChain’s own analytics page, the protocol processed a total of $678 million in the two days following the Bitget hack, compared to $20 million to $60 million daily volume in the week preceding it.

Consequently, it generated a total of almost $1.2 million in “gross system income” over those same two days.

THORChain swaps have been a hacker favorite for some time, and were most notably used to move the majority of the $1.5 billion hacked from ByBit in February last year.

That incident was also linked to North Korean hackers from the so-called “TraderTraitor” operation.

Following the theft, a similar discussion opened up, and a former THORChain developer known as “Pluto” left the project in response.

Similarly, volume spiked immediately following April’s $280 million Kelp DAO hack, as Specter, the investigator who made the North Korean connection in the Bitget case, pointed out in their Telegram group.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

The post THORChain refuses to block Bitget funds, despite pausing after own hack appeared first on Protos.