Community Trust ScoreVerified
The hack hit on September 24. Bitget lost $387.7 million, and within days, stolen funds were already moving across chains — some of them landing on THORChain.
Why It Matters
This incident underscores the ongoing tension between the ethos of decentralization and the practical implications of security in the crypto ecosystem. As decentralized protocols like THORChain face moral and ethical dilemmas regarding the handling of stolen funds, the broader market grapples with the implications of such decisions on trust and user adoption. The discourse surrounding responsibility in decentralized finance (DeFi) could significantly influence regulatory approaches and the future development of governance models across the sector.
Bitget’s CEO Gracy Chen went public fast, urging THORChain to block wallet addresses tied to the attacker. THORChain said no. That refusal cracked open a debate that’s been simmering in crypto for years: when stolen money flows through a permissionless protocol, does the protocol bear any responsibility? And more practically — should it do anything about it? The answers split the industry pretty cleanly, and the fallout from Bitget’s hack is now the clearest example yet of just how deep that split runs.
THORChain Won’t Budge — But It Has Before
THORChain’s position is straightforward on paper. Developer Boone Wheeler said the system has no capability to screen individual transactions, and that halts are reserved for active protocol problems, not for filtering out suspicious wallets. The platform’s whole identity is built around being truly permissionless. Touch one transaction, and the argument goes, you’ve touched them all.
But critics aren’t buying the purity of that stance. Back in May, THORChain validators voted to halt the chain entirely after a $10 million exploit hit the protocol. That’s intervention. It’s a different kind — aimed at fixing a protocol-level problem rather than freezing a user’s funds — but it’s still the validators stepping in and stopping the machine. Wheeler’s explanation is that those two situations aren’t comparable. Maybe. But the optics are messy, and people noticed.
Chen’s view cuts through the technical framing. She drew a line between permissionless infrastructure and what she called facilitating the movement of stolen funds. Her point wasn’t that THORChain should become a compliance tool — it’s that cooperation in tracing and legal recovery matters when stolen assets are identifiable. THORChain, at least for now, doesn’t see it that way.
NEAR Intents Moved Fast, Then Took Heat for It
NEAR Intents did the opposite. The platform activated its automated security layer, called SHIELD, which pulls from public on-chain data and anti-money laundering databases to flag suspicious transactions. NEAR blocked $503,000 in hack-linked funds. It let $166,000 through. Not a perfect record, but it moved.
General Manager Alex Shevchenko framed it as combining openness with financial safeguards. And NEAR waived its share of any recovery bounty — a gesture meant to signal that the intervention was about ethics, not profit.
The backlash came anyway. If NEAR can flip a switch and block transactions, is it really decentralized? That’s the question now following the platform around. The criticism isn’t unfair. A system that can selectively freeze funds based on external databases is a system with controls built in — and controls can be expanded, lobbied for, or legally compelled. That’s the fear, anyway. Unclear yet whether regulators will push on that angle, but the door is open.
The Broader Fight Over Crypto’s Soul
Joël Valenzuela from Dash came down hard against intervention. His worry is censorship — that once you start blocking addresses for one reason, you’ve built the infrastructure to block them for any reason. It’s a slippery slope argument, but in crypto, it’s not an abstract one. Governments and regulators have been circling these platforms for years.
Max Shannon from Bitwise Europe took a different angle. His read is that protocols like THORChain and NEAR are still early, still building trust, and they can’t afford to become known as laundering routes for hack proceeds. He went further — warning that THORChain’s refusal to act might actually push more money laundering activity toward the platform, precisely because bad actors now know it won’t intervene. That’s a real reputational risk, and probably one THORChain’s community will keep arguing about.
The split between these two platforms isn’t really about technology. Both have mechanisms that could theoretically allow intervention. THORChain chose not to use them. NEAR chose to build and deploy one. That’s a values difference, not a capability one.
And it’s not going away. Stolen funds move fast in crypto. Cross-chain swaps happen in minutes. By the time a hack victim files a legal complaint or contacts a platform, the money is often already somewhere else. So the question of whether decentralized protocols should act — and how fast — is pretty much unavoidable now.
What makes the Bitget case stick is the size. $387.7 million is hard to ignore. Smaller hacks get lost in the noise. A number that large forces platforms to say something publicly, to take a position, to defend it. THORChain defended permissionlessness. NEAR defended proactive controls. Both are now living with the consequences of those choices, and so is everyone else building in this space.
Shannon’s warning about laundering activity shifting to THORChain sits out there, unresolved. No details yet on whether that’s already happening. But the $387.7 million is still moving.
Frequently Asked Questions
What was THORChain’s reason for refusing to block hack-linked addresses?
Developer Boone Wheeler said THORChain’s systems have no capability to screen individual transactions, and that halts are only used for active protocol problems — not to filter user funds.
How much did NEAR Intents block from the Bitget hack funds?
NEAR Intents blocked $503,000 in hack-linked funds using its SHIELD system, though $166,000 still passed through. NEAR also waived its share of any recovery bounty.
