Suspected North Korean hackers drained $387.5 million from crypto exchange Bitget last week, and investigators moved quickly to flag and trace the recipient addresses. Bitget CEO Gracy Chen then issued a controversial demand: that decentralized cross-chain swaps platform THORChain “refuse service to these addresses.”

THORChain pushed back, stating: “THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?” The standoff has sharpened a question with stakes far beyond a single hack: how much control a decentralized protocol can exercise before it loses the legal shelter that genuine decentralization provides.

The refusal drew immediate criticism, particularly because the protocol had halted itself without hesitation in May when $10.7 million of its own funds were exploited. Complicating matters further, THORChain has retired its admin key and claims it has no easy way to censor addresses, even if it wanted to.

The controversy is not without precedent. THORChain was previously used to swap roughly $1.2 billion of the funds stolen in the $1.46 billion hack of exchange Bybit — an episode that happened to unfold just 11 days after the protocol retired its admin key. And because THORChain is a swapping venue rather than a mixer, funds that pass through it remain traceable on-chain even after they exit the other side.

NEAR Intents took the opposite approach. Its automated SHIELD program blocked addresses linked to the hack from swapping $50 million on the platform, and it even turned down the 5% bounty Bitget was offering for doing so. Now NEAR Intents finds itself under fire from decentralization maximalists for not being permissionless enough.

To unpack the legal issues at stake, Magazine spoke with Yuriy Brisov of D&A Partners. What follows is an edited version of the conversation.

Magazine: Bitget asked THORChain to block funds tied to the hack, and the protocol responded that it is decentralized and permissionless. Is that a legal defense? Does it have an obligation to block those addresses?

Brisov: It depends on the level of decentralization. When they block addresses, they demonstrate their nodes are not truly decentralized. That is good for the community when the power is used to prevent malicious activity — but at the same time, it opens the project up to any other legal claim. Their only protection is “we are decentralized.”

In the Uniswap case, they said, “we are truly decentralized and there is nothing we can do.” [Investors sued Uniswap after buying 38 rugpull and scam tokens, but a judge dismissed the case in March —Ed.] That is the strongest defense available to any DeFi protocol. If a project shows that it can block, control, or otherwise interfere — even in a good-faith attempt to prevent fraud — it exposes itself to the argument that its control should not be limited to obvious fraud cases. Claimants can insist that the project should also handle due diligence matters, apply KYC, and adopt AML protective measures.

Related: Uniswap beats class action alleging it assisted crypto ‘rug pulls’

Magazine: NEAR Intents blocked those addresses, and Bitget thanked the platform for doing so. Does that mean NEAR has shown Intents is not decentralized and will therefore need to interfere in many other situations?

Brisov: If you demonstrate that you have control over assets, you potentially open yourself to every kind of claim — pump-and-dump schemes, volatility, or any other grievance from investors who were somehow damaged or harmed. They can now say that you have control. Why did you use it in one case and not another? Why don't you vet all the token issuers on your platform? Why don't you provide KYC forms like any centralized exchange?

Magazine: THORChain argues that the May protocol halt was initially triggered by an automated system and that it lacks the ability to block specific addresses. If true, is that a defense?

Brisov: It might be. We don't know yet, because it hasn't been challenged. But any amount of control makes any DeFi project weaker vis-à-vis any claimant.

Magazine: On the other hand, the protocol could upgrade its software if it wished to block certain addresses. Could a project run into legal trouble for recklessness or negligence if it declines to impose such measures?

Brisov: It depends on how it is done on the technical side. Suppose an oracle can detect any North Korean IP address and block it automatically, with no person sitting and pressing a button — “there's a North Korean hacker, let's block him.” Then it is fine. But if a team oversees the situation and says, “We can see this is illicit activity, let's block these addresses,” and presses the button manually, then from a legal point of view — even though it is a good act that benefits the community — the project is not fully decentralized in the legal sense. That strips away the protection that regulations like MiCA [the EU's Markets in Crypto-Assets laws] or the general understanding of the SEC and CFTC provide: that if you are fully decentralized, you cannot be liable for the actions of participants in your ecosystem.

Magazine: NEAR's technology is called SHIELD. It automatically identifies addresses associated with known hacks on public blockchains and blocks them from accessing Intents. Does that make it more likely to be seen as decentralized?

Brisov: Definitely. They show they are good-faith actors building protective measures into their protocols. There is no compliance team of people sitting and controlling the operation manually. This is a smart solution, and it is what we recommend to all DeFi companies.

Magazine: In February 2025, THORChain retired the admin key that would have allowed the core team to make those sorts of unilateral changes. Given the absence of an admin key and the fact that it runs a hundred validators, is the protocol sufficiently decentralized?

Brisov: More likely than not, but we cannot say that for sure. I would say yes.

Magazine: THORChain is not a mixer. Stolen Bitget funds can be swapped on the platform, but when they come out the other end, they remain transparently linked to the Bitget hackers. How does that fit the definition of money laundering? Or is it receiving stolen goods?

Brisov: I don't see how they can be liable for money laundering — even Tornado Cash, which was to a certain extent made to launder money, [avoided US sanctions as immutable smart contracts are not sanctionable property in terms of money laundering —Ed.] American law treats something as either property or not property. Money laundering is illegally moving property through legal channels: you generate proceeds of illicit activity, which are property, and then you move them through some channels and try to make them legal. But smart contracts are not property at all. You don't control them. You don't own them. That is how Tornado Cash won its case in court vis-à-vis OFAC sanctions — it simply proved that it has no control over its smart contracts.

Magazine: The Bybit hack happened 18 months ago. Does that mean no legal action will be taken against THORChain, or do these cases simply take a long time?

Brisov: It might definitely happen in the future. After the Bybit case, they seriously opened themselves up to potential claims.

For now, the protocol's decentralization argument remains legally untested — Brisov noted that no challenge to the automated halt has yet been brought — and he said potential claims tied to the Bybit episode could still surface, developments that would test that permissionless defense directly.

Magazine: Big Questions: Does Satoshi actually own 1.1 million Bitcoin?