Key Highlights:
- Bitget CEO Gracy Chen asked THORChain to block swaps from publicly identified attacker addresses.
- THORChain says its emergency halt protects the network but does not selectively freeze individual funds or wallets.
- The dispute highlights the tension between permissionless cross-chain infrastructure and efforts to restrict stolen crypto.
THORChain, a decentralized exchange, is being criticized for how it handles funds linked to major crypto exploits. The situation came into the picture when Bitget CEO Gracy Chen asked the decentralized exchange to stop processing swaps from publicly identified attacker addresses. Chen’s comments raise a simple question about whether a permissionless cross-chain protocol should block wallets that are linked to a known hack from moving funds through its network.
THORChain, however, has pushed back today, September 28, 2026, in an X post. According to the post, the network states that its emergency halt is designed to protect the protocol during a security incident, but it is not a tool for selectively freezing individual funds or blocking specific swaps. Moreover, according to a post by Michael Perklin, pausing the network and stopping one identified wallet are two different actions under the decentralized exchange’s design.
Bitget Asks THORChain to Block Attacker Addresses
Bitget CEO Gracy Chen said the exchange’s attacker addresses are publicly listed and actively tracked. They also formally asked THORChain to refuse service to those addresses. Gracy Chen argued that decentralization should not be used to justify facilitating transactions involving funds known to be stolen. She commented that the crypto niche is watching how THORChain responds to the situation and questioned what accountability the protocol should have when it is aware that funds originate from a major hack.
The remarks followed another security incident involving Bitget, with funds linked to the Bitget exploiter reportedly being sent through the THORChain for asset swaps and cross-chain transfers. Gracy Chen pointed to the earlier $1.6 billion Bybit hack, saying that nearly $1.2 billion in stolen funds was allegedly traced through THORChain as attackers moved between chains. Bitget argues that the attacker addresses are already publicly identified and being tracked by exchanges, blockchain security firms, AML firms, and other participants across the cryptocurrency niche.
Against this backdrop, Chen questioned whether THORChain will continue providing swaps involving those addresses. The particular problem is not simply whether THORChain can identify those addresses. Instead, Bitget is asking what permission its protocol should take after addresses associated with stolen funds have been publicly identified.
Bitget’s request also emphasizes the issues of containing stolen crypto once attackers begin moving assets across several blockchains. With this cross-chain infrastructure providing tools between different networks, exchanges and security firms are increasingly focused on movement tracking of exploited funds after major crypto hacks. For Bitget, the issue is therefore not only whether the attacker addresses are identifiable, but whether protocols and processes for transactions should take extra measures once those links are publicly out.
THORChain Defines Its Role in Handling Stolen Funds
With today’s post, THORChain is explaining why a network halt is a necessary security mechanism intended to safeguard the protocol rather than a tool for freezing funds or individual swaps. Despite the 2026 exploit that resulted in $10.7 million being stolen from liquidity pools, the attackers’ addresses were not blacklisted and were therefore not restricted from swapping on .
The network is described as permissionless and created not to censor transactions. It characterizes THORChain as a neutral public good, reflecting the argument that blocking specific addresses would conflict with its decentralized design and that a network-wide halt can be used as an emergency response to safeguard the protocol, while blocking particular addresses would show a different form of intervention.
Bitget’s remarks focus on the recurrent movement of funds linked with known exploits. Chen argued that if attackers can repeatedly use THORChain to move assets across networks, including swaps such as ETH to BTC, the industry needs to consider what responsibility the protocol should have when handling publicly identified stolen funds.
The disagreement therefore emphasizes a wider tension between permissionless infrastructure and intervention in response to criminal activity: Bitget is calling for action against specific addresses, while THORChain’s stated design principles highlight neutrality and resistance to censorship.
