THORChain, a decentralized cross-chain liquidity network that routes asset swaps directly between blockchains, has turned down a request to blacklist wallet addresses linked to the Bitget exchange hack, pointing to the protocol's commitment to censorship resistance. The refusal came as Ethereum co-founder Vitalik Buterin separately commented on how Ethereum approaches comparable questions of network neutrality, placing both networks at the center of a long-running debate over where responsibility for stolen funds should sit in a decentralized stack.

THORChain Declines to Block Addresses Tied to the Bitget Hack

The decision places THORChain squarely within a recurring tension in decentralized finance: whether permissionless infrastructure can — or should — selectively block funds to known exploits. Under THORChain's core design, address-level neutrality is treated as a protocol property rather than an administrative setting. Implementing a blacklist would require either a hard fork — a change to the protocol's rules that node operators would have to adopt — or an off-chain governance mechanism capable of overriding liquidity routing, and the protocol's node operators have historically declined to adopt either approach.

The refusal should not be read as an endorsement of the hack or its proceeds. It follows the same logic applied in earlier cases in which hackers used THORChain to swap stolen bitcoin after other venues had frozen the relevant addresses. In each instance, THORChain's position has been consistent: a cross-chain liquidity layer cannot double as a compliance enforcement layer without undermining the trustlessness that gives it value to legitimate users.

Attackers' Trail Through Mixers and Bridges

The Bitget incident is not an isolated case. On-chain investigators had already connected part of the stolen to mixing activity before the tokens reached a cross-chain bridge. AMLBot traced 4 BTC from the Bitget hack to a Wasabi CoinJoin transaction — CoinJoin being a privacy technique that pools payments from multiple users into a single transaction, breaking the direct on-chain link between sender and recipient — illustrating the lengths to which attackers go to obscure fund flows before routing them through protocols like THORChain.

The refusal also extends a familiar pattern. In prior hacks, THORChain served as a routing layer despite pressure from law enforcement and exchanges to block the funds. Blockchain researcher ZachXBT has previously estimated that THORChain exploit losses may exceed $10 million across related incidents, a figure that suggests the protocol is a structurally attractive exit route for attackers operating across chains. Each refusal to blacklist reinforces that perception, regardless of the protocol's intent.

Buterin's Comments Frame the Neutrality Question

Buterin's remarks on Ethereum, which the headline references but does not quote in full, land in the same governance territory. He has written and spoken extensively on the distinction between Ethereum as a base layer remaining neutral, and application-layer or social-layer actors choosing to act against known bad behavior. The precise framing of his latest comment was not available in verified material for this article, and reconstructing it from paraphrase would be speculative.

What the two situations share is a structural question: at what layer of a decentralized stack does responsibility for handling stolen funds appropriately sit? THORChain's answer is that the protocol layer carries none. Ethereum's ongoing debate, in which Buterin participates, concerns whether validator-level or client-level coordination should ever be used for similar ends, and whether doing so would erode the credibility of neutrality claims at the base layer. Ethereum remains the largest smart contract ecosystem by total value locked — a widely used measure of the capital deposited in a chain's decentralized applications — making any shift in its neutrality posture consequential for the DeFi protocols that depend on its infrastructure.

Recovery Routes Remain Off the Protocol Layer

For those tracking hacked funds, the practical implication is that neither THORChain's refusal nor Ethereum's neutrality debate closes off recovery options at the protocol level. Recovery typically proceeds through cooperation from centralized exchanges, on-chain tracing by firms such as AMLBot or researchers like ZachXBT, or legal action against identifiable counterparties. The THORSwap wallet exploit demonstrated this dynamic: the protocol itself was never modified, but off-chain coordination and bounty mechanisms supplied a partial resolution path.

For developers of decentralized AI and compute infrastructure watching this space, the more durable question is whether governance modules — including on-chain voting systems that could in theory implement address-level restrictions — will be treated as a feature or a flaw. Protocols that hardcode censorship resistance at the consensus layer gain credibility with users of neutral infrastructure; those that leave room for governance-level intervention may find that flexibility becomes a pressure point every time a high-profile hack pushes funds through their liquidity pools. Ethereum's token market metrics reflect that base-layer credibility carries market value, a signal that cross-chain protocols like THORChain are betting their own positioning on as well. How THORChain's node operators respond the next time stolen funds reach the network, and whether Ethereum's neutrality debate produces any movement toward validator-level coordination, are the open questions most likely to test that positioning going forward.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.