Request

TRON

Gracy

THORChain

Threshold

THORChain has rejected calls to block addresses linked to Bitget’s September 24 exploit, defending its permissionless architecture as criticism mounts over whether its validator-controlled vaults make the protocol comparable to Bitcoin or Ethereum.
Bitget has now confirmed approximately <a href="https://www.bitget.com/support/articles/12560603896108" rel="noopener noreferrer nofollow">$387.5 million</a> was transferred to attacker-controlled addresses during the <a href="https://cryptoadventure.com/bitget-confirms-351-6m-wallet-breach-and-suspends-withdrawals/" rel="noopener noreferrer nofollow">wallet breach</a>, up from its initial $351.6 million estimate after additional Zcash and TRON transactions were classified.
Bitget CEO Gracy Chen publicly asked THORChain to <a href="https://x.com/GracyBitget/status/2103812967066439817" rel="noopener noreferrer nofollow">refuse service to the identified addresses</a>, writing that “decentralization is a design principle, not a shield for facilitating known stolen funds.”
THORChain described itself as <a href="https://x.com/THORChain/status/2103911825490203083" rel="noopener noreferrer nofollow">“decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain”</a> and asked what responsibility those networks should bear when known stolen funds pass through them.
<h2 id="star-xu-challenges-thorchain-s-bitcoin-comparison">Star Xu Challenges THORChain’s Bitcoin Comparison</h2>
OKX founder and CEO Star Xu disputed the comparison, focusing on THORChain’s Threshold Signature Scheme and validator-controlled vault architecture.
Xu argued that THORChain’s <a href="https://x.com/star_okx/status/2103921954340385100" rel="noopener noreferrer nofollow">selected validator set collectively controls assets</a> held inside its TSS vaults and can move those assets once the required signing threshold is reached. He described the protocol as an intermediary between users and the native chains, adding: “Distributing an intermediary does not eliminate the intermediary.”
He followed with a second response pointing to THORChain’s own intervention during its <a href="https://cryptoadventure.com/thorchain-exploit-report-details-10-7m-vault-drain-and-adr-028-recovery-path/" rel="noopener noreferrer nofollow">May vault exploit</a>, arguing that its ability to stop network activity separates it from Bitcoin’s base-layer architecture.
THORChain’s <a href="https://blog.thorchain.org/thorchain-exploit-report-1" rel="noopener noreferrer nofollow">incident report</a> confirms that automatic solvency controls first halted signing and trading across several chains after approximately $10.7 million was drained. <a href="https://cryptoadventure.com/community/articles/what-are-crypto-node-operators/" rel="noopener noreferrer nofollow">Node operators</a> then stacked manual pauses and cast Mimir governance votes, bringing trading, signing, chain observation and churning to a full controlled halt within roughly two hours.
The protocol’s <a href="https://blog.thorchain.org/thorchain-quarterly-report-q2-2026" rel="noopener noreferrer nofollow">Q2 report</a> records a substantially longer disruption than the 13-hour period cited in Xu’s post: THORChain remained offline for roughly five weeks before restarting on June 22 with patched TSS code and the ADR-028 recovery framework.
<h2 id="thorchain-documentation-confirms-broad-halt-powers">THORChain Documentation Confirms Broad Halt Powers</h2>
THORChain’s <a href="https://docs.thorchain.org/thornodes/emergency-procedures" rel="noopener noreferrer nofollow">emergency procedures</a> explicitly describe <code>make pause</code> as the “big red button that stops everything.” A node operator can initiate a 720-block network pause, while additional operators can extend it. Nodes can also vote through Mimir to halt signing for individual connected chains.
Those controls establish that <a href="https://cryptoadventure.com/thorchain-dex-review-2026-native-cross-chain-swaps-rune-security-and-slip-based-fees/" rel="noopener noreferrer nofollow">THORChain</a> operators can interrupt protocol activity. The published documentation does not describe an equivalent protocol-level mechanism for selectively blacklisting one external wallet while allowing all other swaps to continue.
MistTrack, SlowMist’s onchain tracking platform, also entered the dispute after tracing Bitget-related funds into THORChain for swaps and cross-chain transfers. It argued that <a href="https://x.com/MistTrack_io/status/2103403250183815294" rel="noopener noreferrer nofollow">“decentralization should not become a blanket excuse”</a>when publicly flagged stolen funds are involved.
Security researcher Taylor Monahan separately <a href="https://x.com/tayvano_/status/2104018935574335613" rel="noopener noreferrer nofollow">challenged THORChain’s non-intervention argument</a>, pointing to the network’s established ability to pause operations and coordinate protocol changes.
Bitget says some affected assets have already been frozen through cooperation with exchanges, blockchain projects and security firms. Its recovery program now offers a 5% bounty for eligible actions that directly result in stolen assets being frozen or recovered.
The post <a href="https://cryptoadventure.com/thorchain-pushes-back-on-bitget-block-request-as-star-xu-questions-decentralization-claim/" rel="noopener noreferrer nofollow">THORChain Pushes Back on Bitget Block Request as Star Xu Questions Decentralization Claim</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

THORChain Pushes Back on Bitget Block Request as Star Xu Questions Decentralization Claim

Table of Contents

Crypto Adventure

Other articles published on Sep 27, 2026

Join our free newsletter for daily crypto updates!