Bitget’s demand for THORChain intervention tests crypto’s neutrality

Bitget’s request follows a sophisticated security breach involving internal credentials rather than compromised cold wallets. As the stolen assets migrated across Ethereum, BNB Chain, and Bitcoin, they passed through various liquidity pools and bridges. Bitget argues that THORChain should effectively blacklist the attacker, yet this shifts the burden onto a protocol maintained by independent node operators. Unlike a centralized exchange, THORChain operates through threshold signatures, meaning any blacklist would require a fundamental change to the network's transaction rules and broad consensus from its governance participants.

Demanding that decentralized networks intervene during a theft creates a precedent that could disrupt legitimate users. THORChain does possess emergency controls, including chain-specific trading halts, but deploying these for every external exploit risks turning the protocol into a discretionary arbiter of legality. With the attacker utilizing at least a dozen different services—including Uniswap and various cross-chain bridges—blocking one venue provides little more than a temporary hurdle. Public transaction records have already proven more effective than intervention, as investigators successfully mapped 28 attacker-controlled addresses across eight networks. For an industry built on permissionless access, the challenge lies in balancing the recovery of stolen assets against the risk of compromising the very infrastructure meant to remain neutral.