THORChain refuses to block Bitget funds, despite pausing after own hack
DeFi project THORChain has turned down a formal plea to “refuse service” to addresses associated with the recent hack of Bitget, a centralized crypto exchange which lost over $380 million on Thursday night.
The decision comes four months after THORChain halted trading after it was hacked for $10 million.
In the aftermath of Thursday’s hack, Bitget CEO Gracy Chen called it “highly consistent with known patterns of North Korean hacker organizations,” after on-chain analysts spotted connections to wallets used following previously attributed hacks.
Read more: Bitget’s eighth birthday ends with a $352M hack
Both Chen and blockchain security firm SlowMist, which is supporting Bitget with tracing the stolen funds, appealed to THORChain, with the latter urging that “decentralization should not become a blanket excuse when dealing with known stolen funds.”
Addressing the calls to take action, THORChain said it was “devastated to hear” of Bitget’s hack, but that it is “decentralized and permissionless.”
It compared itself to “Bitcoin, Ethereum, and BNB Chain,” asking if those networks would be expected to halt when stolen funds passed through them.
Notably, following a $600 million hack in 2022, BNB Chain validators did indeed halt the chain, preventing the attacker from extracting the majority of the loot.
Read more: Explained: How $600M was stolen from Binance’s BNB chain
THORChain’s refusal is widely seen as hypocritical considering its validators previously took swift action to halt trading in response to being hacked itself for approximately $10 million back in May.
Revisiting the episode, THORChain has stressed the halt was to protect the protocol, it never selectively blacklisted the hacker, and that it “doesn’t censor by design.”
According to THORChain’s own analytics page, the protocol processed a total of $678 million in the two days following the Bitget hack, compared to $20 million to $60 million daily volume in the week preceding it.
Consequently, it generated a total of almost $1.2 million in “gross system income” over those same two days.
THORChain’s track record
THORChain swaps have been a hacker favorite for some time, and were most notably used to move the majority of the $1.5 billion hacked from ByBit in February last year.
That incident was also linked to North Korean hackers from the so-called “TraderTraitor” operation.
Following the theft, a similar discussion opened up, and a former THORChain developer known as “Pluto” left the project in response.
Similarly, volume spiked immediately following April’s $280 million Kelp DAO hack, as Specter, the investigator who made the North Korean connection in the Bitget case, pointed out in their Telegram group.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.