THORChain developers have declined a request from Bitget to block funds tied to the exchange's $387.5M hack, according to a September 28 report from Wu Blockchain. The protocol's position: it has no mechanism to censor a specific user, and adding one would break the neutrality it was built on. The refusal drops the recovery effort back into the exchange's lap and reopens a debate the cross-chain swap protocol has faced before.
The request and the refusal
Bitget confirmed a hack exceeding $350M earlier this month and has since begun restoring services, including a phased withdrawal restart from September 28. Part of the response has been chasing the money on-chain. THORChain surfaced as a route the attacker used to swap assets across chains, which is why Bitget turned to it.
THORChain's answer was that it cannot do what was asked. The protocol runs as a decentralized network of validators without an admin key that can pause an address or claw back a transfer. Blocking one user would require node operators to agree to a form of transaction censorship that the network has no standing process for, and that many operators oppose on principle.
The design that serves traders and launderers alike
THORChain lets users swap native assets across chains without wrapping tokens or routing through a single custodian. That is useful for ordinary traders and equally useful for someone holding stolen coins who wants to convert them into something harder to trace. The same design choice that removes a middleman also removes the party that could freeze the flow.
This is the recurring tension. A centralized exchange can freeze an account, reverse an internal transfer, or comply with a law enforcement order because it holds the assets and controls the ledger. A protocol like THORChain holds nothing and controls no one. When funds are stolen, that difference stops being abstract. There is no desk to call and no button to press.
The decentralization tradeoff, stated plainly
Censorship resistance is not a slogan here. It is the property that determines whether the network can block funds at all, and THORChain is saying it cannot without becoming something else. If validators could vote to freeze a hacker today, they could be compelled to freeze a sanctioned address, a political donation, or a competitor tomorrow. The protocol's defenders argue that a network with a freeze switch is just a slower centralized intermediary.
The counterargument is straightforward. Refusing to act means stolen money keeps moving, and the victims, in this case Bitget and by extension its users, absorb the loss. Neutrality that protects a thief is a hard thing to defend to the person who was robbed. Both things are true at once, which is why the decision is contentious rather than obvious.
For anyone weighing DeFi yields and spending from a wallet you control against centralized options, this is the fine print behind the pitch. The absence of an intermediary is the feature and the risk in the same sentence. No one can freeze your funds, and no one can freeze anyone else's either.
Recovery, if it comes, will be off-chain
The practical outcome is that recovery, if it happens, will not come from THORChain flipping a switch. It would have to come through off-chain pressure: exchanges flagging the tainted assets as they arrive, analytics firms tracing the trail, and law enforcement acting at the points where crypto touches identified accounts. Those are the same choke points that have recovered stolen funds before, and they sit at the centralized edges of the system, not inside the protocol itself.
Bitget, for its part, has kept its focus on restoring user access rather than promising the stolen assets back. The exchange confirmed the scale of the breach and moved to reopen withdrawals in stages, which suggests it is treating the loss as a hole to backfill operationally rather than one it expects to reverse on-chain.
Markets were broadly soft as the story circulated. Bitcoin traded near $83,050, down about 1.9% on the day as of September 28, 2026, with the Fear and Greed index still reading 69 (Greed), per CoinMarketCap. The hack itself was not the driver of that move, but it lands during a stretch where exchange security has been front of mind.
Overview
Bitget asked THORChain to block funds linked to its $387.5M hack. THORChain refused, saying it has no mechanism to censor a user and will not build one. The decision keeps the protocol's censorship resistance intact and leaves recovery to the centralized edges of the system, where exchanges and law enforcement can still act. It is a clean illustration of the DeFi tradeoff: a network no one can stop from moving your money is also a network no one can stop from moving stolen money.
