THORChain has rejected requests to freeze wallet addresses linked to the Bitget attacker. Meanwhile, CoinDesk detected that approximately $6.3 million in stolen funds was laundered from Ethereum to Bitcoin via the protocol. Across 27 successful swap transactions, around 2,390 ETH was exchanged for 75.2 BTC.
These transactions took place on Monday (September 28), the same day Bitget allowed users to withdraw Bitcoin again. While the exchange was working to remediate the incident, the perpetrator took advantage of the situation to launder assets through a non-intervenable transfer channel.
Who asked, who refused, and why?
To recover the approximately $388 million in lost funds, Bitget published a list of the attacker’s wallet addresses and requested that THORChain block all associated transactions. To incentivize cooperation, the exchange also offered a bounty of up to 5% to any individual or entity capable of freezing or recovering the stolen assets.
However, THORChain rejected the request due to fundamental technical constraints. The protocol explained that its current emergency tools only allow it to halt the entire network, rather than intervene in or freeze a specific transaction or address.
This limitation stems from the system’s structural nature rather than governance policy. To maintain permissionless asset swaps for all users, the protocol must treat all addresses equally. Introducing selective blacklisting would place the authority to add or remove addresses into the hands of a controlling party, thereby undermining users’ fundamental trust in the platform.
Why swap Ethereum for Bitcoin?
Converting 2,390 ETH to Bitcoin in a single day was well within the attacker’s plan. Since the majority of the stolen Bitget funds were in ETH and cross-chain tokens, they needed a deep liquidity pool to convert into an asset that is easier to disperse, facilitating the movement of funds into multiple new wallets.
The entire swap process on THORChain is fully automated without requiring manual intervention, executing immediately upon matching liquidity without undergoing any manual censorship.
Notably, the 5% bounty offered by Bitget cannot have a direct impact on the protocol itself. The reward only works if a third party proactively intervenes—such as another platform voluntarily freezing assets without being obligated to. Meanwhile, THORChain has affirmed its stance of non-involvement in the process.
Earlier this month, THORChain faced backlash for inadvertently facilitating fund flows from another hack. In this incident, the platform remained steadfast in its anti-blacklisting principle, even if that meant allowing illicit funds to continue circulating.
The key takeaway: When a breached exchange is forced to track funds through decentralized protocols where intervention is impossible, asset recovery relies entirely on coordination with partner exchanges, rather than merely relying on a promised bounty.