THORChain, a decentralized cross-chain liquidity protocol, is facing significant backlash after stolen funds from a major security incident at cryptocurrency exchange Bitget were reportedly laundered through its platform. The incident, which saw Bitget lose over $387 million on September 25, 2026, has intensified a long-standing debate over the responsibilities of decentralized finance (DeFi) protocols in preventing illicit financial activities, particularly concerning the THORChain Bitget hack.
Bitget CEO Gracy Chen publicly challenged THORChain, demanding it refuse service to attacker addresses. “Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching,” Chen stated, underscoring the growing pressure on protocols to balance their permissionless nature with accountability.
Controversy ignites over the THORChain Bitget hack
The controversy stems from a noticeable spike in THORChain’s trading activity between September 24 and September 26, 2026, coinciding with the Bitget hack. Data indicates THORChain’s swap volume surged to $1.72 billion by September 26, a substantial rise from $610 million recorded in August. Concurrently, its fees climbed to $479,033.13 from $145,464.59.
Blockchain security firm GoPlus Security further fueled the debate on September 27, 2026, challenging THORChain’s claims of strict decentralization. They reported approximately 101.5 BTC exited and 27.63 million XRP were being routed toward Bitcoin through the protocol by the alleged attackers. This suggests a systematic effort to obfuscate the origin of the stolen assets.
Bitget’s Gracy Chen explicitly named THORChain, formally requesting the protocol to block specific attacker addresses. Her remarks highlight a critical tension: while DeFi protocols champion censorship resistance, the financial industry and regulatory bodies increasingly expect a degree of intervention when criminal activities are involved.
The decentralization debate intensifies
THORChain has defended its position by asserting its status as a decentralized and permissionless protocol, akin to Bitcoin, Ethereum, and BNB Chain. It posed a rhetorical question: “What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?” This argument frames the issue as a fundamental characteristic of truly decentralized systems.
However, Mingxing Xu, founder of OKX, countered THORChain’s direct comparison to base-layer blockchains. Xu explained that Bitcoin’s network inherently cannot be stopped by a central authority. Bitcoin operates without a group of individuals signing transactions.
In contrast, THORChain’s cross-chain infrastructure relies on Threshold Signature Scheme (TSS) vaults, which are controlled by a group of participating validators. These validators collectively provide signatures for transactions. This mechanism, Xu argued, means “Bitcoin cannot be stopped. THORChain can—it simply chooses when to do so.”
GoPlus Security echoed this sentiment, stating THORChain “has never been strictly decentralized” and should not compare itself to Layer 1s like Bitcoin and Ethereum. Ethereum still faces significant market challenges as its fundamental architecture differs.
A pattern of illicit activity and past interventions
This isn’t the first time THORChain has faced such scrutiny. In February 2025, the North Korean Lazarus Group reportedly used THORChain to launder funds from a $1.4 billion Bybit hack. Bybit CEO Ben Zhou stated that 72% of the stolen funds, amounting to 361,255 ETH, flowed through THORChain.
Taylor Monahan, lead security researcher at MetaMask, estimated $900 million worth of crypto was laundered by the Lazarus Group via the protocol. This past incident underscores a recurring pattern of illicit fund movement through the platform.
Critics point to THORChain’s past interventions as evidence of ‘selective decentralization.’ For instance, in May 2026, the protocol halted its network for about five weeks after an exploit drained approximately $10.7 million from one of its vaults.
Node operators coordinated through Discord and utilized manual pauses and Mimir votes to stop network activity. This demonstrates a clear capacity for collective action and control over the protocol, which some argue contradicts its ‘permissionless’ defense.
Developer Pluto resigned in March 2025 following the Bybit hack controversy, and validator TCB threatened to leave if governance issues regarding illicit flows weren’t addressed. TCB also highlighted concerns about the network’s validator onboarding process, which could lead to a small group controlling crucial infrastructure. These governance issues highlight broader challenges in decentralised systems. Polkadot navigates market consolidation with its own unique governance structure.
Industry eyes protocol accountability
The broader crypto industry is closely observing THORChain’s response, recognizing the implications for DeFi’s future. Rachel Lin, CEO of decentralized exchange SynFutures, noted that while human intervention might contradict decentralization’s ethos, ‘protocol-level innovations could automate safeguards against illicit activity.’ This suggests a potential path forward that maintains decentralization while addressing calls for greater responsibility.
Legal experts also weigh in on the complexities. Yuriy Brisov, a partner at crypto legal consulting firm D&A Partners, cautioned that THORChain’s decentralized nature ‘does not fully insulate it from the legal ramifications of facilitating illicit transactions.’ This legal perspective adds another layer of pressure on protocols operating in a largely unregulated space.
Regulatory precedents, such as the US Treasury’s sanctioning of Tornado Cash in 2022 and FBI scrutiny of Railgun in 2023 for facilitating illicit funds, loom large. These cases illustrate a growing trend of authorities targeting decentralized mixers and protocols perceived as enabling criminal activity. Such actions underscore the increasing legal pressure on the DeFi ecosystem.
For Jito token holders, understanding evolving regulatory stances is crucial.
Despite the criticisms, THORChain’s native token, RUNE, showed resilience, trading at $0.7908 at press time, marking a 15.8% hike in the past 24 hours. Meanwhile, Bitget continues its investigation into the breach, with withdrawals remaining suspended as it collaborates with law enforcement and blockchain-security firms.
The ongoing situation with THORChain and the Bitget hack underscores a pivotal challenge for the DeFi sector: how to uphold the principles of decentralization and censorship resistance while simultaneously building trust and preventing their misuse by bad actors. The industry’s scrutiny reflects a collective effort to define the boundaries of responsibility in a permissionless financial system.