THORChain has reportedly declined to block wallets allegedly tied to a Bitget exchange hack, allowing an estimated $387.5 million to be swapped into Bitcoin through the decentralized cross-chain protocol. The reports, which circulated within the crypto security community, prompted calls for the protocol to intervene and freeze the associated swap routes — requests that THORChain, which enables trustless cross-chain asset swaps including routes that settle into Bitcoin, reportedly did not act upon.

The figures and attribution remain unverified. The $387.5 million total has not been independently confirmed by on-chain data made available in this reporting, and the link between the wallets and the Bitget incident remains alleged rather than established.

Why a Decentralized Protocol Cannot Simply Freeze Swaps

THORChain operates without a central authority holding a kill switch. Transaction validation is distributed across node operators, and blocking a specific address requires a governance action or coordinated node-level decision rather than a single operator's call. That stands in contrast to centralized exchanges, which can freeze accounts unally.

The distance between identifying a suspicious address and enforcing a blocklist is substantial in permissionless infrastructure. Even if node operators reached consensus to halt a wallet, the protocol's censorship-resistant design — the same property that makes it attractive to legitimate cross-chain users — creates friction for intervention. A similar tension surfaced previously when a Coldcard hacker used THORChain to swap stolen BTC under comparable structural constraints.

Requests to block stolen funds place protocol governance in a difficult position. Acting selectively undermines the neutrality that gives decentralized infrastructure its credibility, while inaction draws scrutiny from exchanges, law enforcement, and regulators who expect cooperation.

Implications for Exchanges, Users, and Cross-Chain Oversight

When large sums of allegedly stolen assets move through decentralized routing protocols and settle into Bitcoin, attribution and recovery become significantly harder. Bitcoin's pseudonymous UTXO model means tracing requires sustained chain analysis, and there is no mechanism to reverse a confirmed transaction.

The episode fits a broader pattern of cross-chain protocols attracting post-hack fund flows, a dynamic that has previously drawn regulatory attention. THORChain has itself faced scrutiny following a reported exploit affecting multiple blockchains, which led to a temporary liquidity pause by node operators. Whether that precedent informs any governance response to the Bitget-linked activity remains unclear.

Exchanges and wallet infrastructure providers face mounting pressure to screen incoming funds for taint, regardless of whether the routing layer cooperated with any interdiction request. The movement of funds at this scale into Bitcoin also raises questions about whether decentralized swap protocols will face stricter travel-rule compliance expectations — a debate already underway in several jurisdictions.

What Remains Unconfirmed

Attribution of the wallets to the Bitget incident, the total sum involved, and THORChain's official position on any intervention request all remain unconfirmed as of publication. Any tracing and recovery efforts that may be underway are ongoing and uncertain in outcome. Developments that would clarify the episode include whether THORChain node operators or its governance process formally address the freeze requests, whether on-chain analysts publish evidence corroborating or disputing the reported totals, and whether exchanges receiving the converted bitcoin flag incoming deposits as tainted.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.