Rujira

Request

Gracy

THORChain

<p><strong>THORChain has pushed back against a formal request from Bitget CEO Gracy Chen to block wallet addresses linked to a hack that drained approximately $387.5 million from the exchange, reigniting a debate over whether decentralized cross-chain protocols should deny service to known bad actors.</strong></p>
<p>Bitget's on-chain tracing update revised its initial loss estimate upward from $351.6 million after investigators identified attacker-controlled receiving addresses across Ethereum and other EVM-compatible networks, the XRP Ledger, Zcash, and TRON. The exchange says the incident is now contained and that no further unauthorized transfers are possible. For related coverage, see <a href="https://www.kanalcoin.com/binance-supports-thorchain-upgrade-june-2025/" rel="noopener noreferrer nofollow">Binance Supports THORChain RUNE Network Upgrade June 2025</a>.</p>
<figure style="margin:1.25rem 0;padding:1.25rem 1.5rem;border:1px solid #d9dee7;border-radius:10px;background:#f7f9fc;">
 <div style="font-size:0.8rem;letter-spacing:0.08em;text-transform:uppercase;color:#586174;margin-bottom:0.45rem;">
  Bitget confirmed transfer total
 </div>
 <div style="font-size:2.25rem;line-height:1.1;font-weight:700;color:#162033;">
  $387.5 million
 </div>
 <figcaption style="margin-top:0.6rem;font-size:0.9rem;line-height:1.4;color:#586174;">
  Revised from an initial $351.6 million estimate.
 </figcaption>
</figure>
<p>Chen publicly asked THORChain to refuse service to the listed attacker addresses, <a href="https://news.bitcoin.com/featured/bitget-ceo-wants-thorchain-to-block-hackers-but-theres-a-catch/" rel="noopener noreferrer nofollow">according to Bitcoin.com News reporting</a>. THORChain responded by describing the protocol as decentralized and permissionless in the same manner as Bitcoin, Ethereum, and BNB Chain, and asked what responsibility those base-layer networks bear for handling known stolen funds. For related coverage, see <a href="https://www.kanalcoin.com/bybit-support-thorchain-rune-v3-19-0-network-upgrade/" rel="noopener noreferrer nofollow">Bybit to Support THORChain (RUNE) v3.19.0 Network Upgrade</a>.</p>
<h2 id="why-the-permissionless-argument-divides-the-industry">Why the "permissionless" argument divides the industry</h2>
<p>The protocol's stance drew immediate disagreement from prominent figures. Bitcoin.com News reports that OKX founder Star Xu and Dashpay's Joel Valenzuela <a href="https://news.bitcoin.com/crypto-news/thorchain-faces-heat-as-bitget-hack-revives-bybit-controversy/" rel="noopener noreferrer nofollow">took opposing positions</a> on whether THORChain should act against the flagged addresses. The split reflects a recurring tension in the industry between the technical neutrality of open protocols and their practical role in facilitating the movement of stolen funds.</p>
<p>The dispute echoes a controversy earlier in 2025, when THORChain faced criticism after reportedly facilitating an estimated $1.2 billion in fund flows tied to the Bybit hack. That incident, combined with the current Bitget case, puts sustained pressure on THORChain's governance community to define a public policy on sanctioned addresses. For Southeast Asian exchanges such as Indodax, Tokocrypto, and Coins.ph, which route cross-chain liquidity through protocols like THORChain, the outcome of that debate has direct compliance implications.</p>
<h2 id="what-blocking-would-and-would-not-achieve">What blocking would and would not achieve</h2>
<p>Attacker-controlled addresses in the Bitget incident span multiple blockchains, meaning any action by THORChain would address only the cross-chain routing layer, not the underlying chains where the funds currently sit. Bitget's own update confirms the stolen assets are spread across EVM networks, XRP Ledger, Zcash, and TRON, each with independent infrastructure. A THORChain block would limit the attacker's ability to swap assets permissionlessly across those chains but would not freeze the funds outright.</p>
<p>THORChain's native token RUNE was trading at <a href="https://www.coingecko.com/en/coins/thorchain" rel="noopener noreferrer nofollow">$0.752888</a> at the time of data capture, down 0.91% over 24 hours, against a broader crypto market reading a Fear &amp; Greed score of 70 (Greed). The muted price reaction suggests markets are treating this as a governance and reputational issue rather than an immediate protocol-level risk. Previous coverage of <a href="https://www.kanalcoin.com/thorchain-rune-upgrade-market-reactions/" rel="noopener noreferrer nofollow">THORChain RUNE upgrade execution and market reactions</a> shows the token has historically been sensitive to governance news.</p>
<figure style="margin:1.25rem 0;padding:1.25rem 1.5rem;border:1px solid #d9dee7;border-radius:10px;background:#f7f9fc;">
 <div style="font-size:0.8rem;letter-spacing:0.08em;text-transform:uppercase;color:#586174;margin-bottom:0.45rem;">
  RUNE spot price
 </div>
 <div style="font-size:2.25rem;line-height:1.1;font-weight:700;color:#162033;">
  $0.752888
 </div>
 <figcaption style="margin-top:0.6rem;font-size:0.9rem;line-height:1.4;color:#586174;">
  24-hour change: −0.91%.
 </figcaption>
</figure>
<p>The case is the latest in a growing list of incidents involving cross-chain infrastructure. A <a href="https://www.kanalcoin.com/crypto-bridge-suffers-11-million-hack/" rel="noopener noreferrer nofollow">previous crypto bridge hack</a> involving $11 million demonstrated how fragmented blockchain environments complicate coordinated responses. THORChain's <a href="https://www.kanalcoin.com/rujira-extends-defi-thorchain/" rel="noopener noreferrer nofollow">expanded DeFi capabilities through Rujira</a> have also broadened its attack surface and increased the stakes of governance decisions around address filtering.</p>
<h2 id="what-comes-next-for-thorchain-and-regional-exchanges">What comes next for THORChain and regional exchanges</h2>
<p>The unresolved question is whether THORChain node operators will act unilaterally, whether the broader community will pass a governance proposal, or whether the protocol will maintain its current position. Bitget has published the primary attacker-controlled addresses for each affected network, so any future block would be technically straightforward to implement if the community chose to do so.</p>
<p>For regulators across the ASEAN region, where several jurisdictions are finalizing virtual asset service provider frameworks, the THORChain response sets an informal precedent: decentralized protocol operators may resist external pressure to restrict access even when stolen funds are publicly identified. That stance will likely feature in ongoing regulatory consultations in Singapore, Thailand, and the Philippines, where licensing regimes increasingly require exchanges to demonstrate they are not facilitating the movement of illicit assets.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px;">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.kanalcoin.com/?p=69286" rel="noopener noreferrer nofollow">Read original article on kanalcoin.com</a>

Thorchain Responds to $387.5M Hack Address Blocking Request

Table of Contents

Kanalcoin

Other articles published on Sep 27, 2026

Join our free newsletter for daily crypto updates!