Cross-chain Protocol THORChain: Heartbroken by Recent Exchange Attacks, Itself a Decentralized and Permissionless Protocol Like Bitcoin
THORChain responded to criticisms from the on-chain tracking platform MistTrack regarding its repeated use for transferring stolen funds from Bybit and Bitget, expressing sorrow over the recent exchange attacks. It emphasized that it is a decentralized and permissionless protocol like Bitcoin, Ethereum, and BNB Chain, and questioned what responsibility these three chains should bear when handling known stolen funds.
MistTrack pointed out that the funds from the Bitget attacker were exchanged through THORChain; in last year's theft of approximately $1.46 billion from Bybit, nearly $1.2 billion was also exchanged through the same protocol from ETH to BTC. The platform believes that "decentralization" cannot automatically serve as a disclaimer for handling known stolen funds, specifically naming paths such as ETH to BTC and BNB to BTC.
After Bitget revised its losses to approximately $387.5 million, the CEO publicly listed the attack addresses and formally requested THORChain to refuse service, stating that decentralization should not greenlight known stolen funds. The protocol did not initiate a new chain halt vote against the Bitget addresses. During the Bybit incident in 2025, three validators voted to suspend ETH trading, which was overturned by four votes within minutes, leading to the resignation of core developers.
THORChain has the capability to halt operations: after approximately $10.7 million was transferred from its treasury by a newly joined node exploiting a threshold signature vulnerability in May 2026, the payment detection automatically stopped multi-chain signatures and transactions within about 52 minutes, leading to a network suspension of approximately 39 days. Nodes are required to stake a large amount of RUNE, and a two-thirds majority can suspend trading.
Circle and Tether have frozen approximately $318,000 in stablecoins at the attack addresses; XRP, BNB, and TRX on the THORChain path were exchanged for Bitcoin. On September 25, the protocol's fee income was approximately $381,700, the highest in nearly five months.
In market mechanisms, the narrative bought is "equating protocol responsibility with public chain neutrality," while the sell is for permissionless native asset exchanges. Funds from the named exchanges' hot wallets enter the THORChain treasury and then flow out as BTC; fees go to nodes and liquidity providers. Beneficiaries are validators continuing to handle large bridge orders; those under pressure are the publicly named addresses, exchanges demanding service refusal, and tracking platforms. This is a struggle over governance will, not a technical dispute over interception capabilities.
Source: Public Information
ABAB AI Insight
THORChain reframes the issue from "can nodes vote to halt certain addresses" to "should Bitcoin be responsible for routing stolen funds." The two are not on the same level: Bitcoin does not provide cross-chain exchanges and does not collect bridge fees; THORChain's treasury actively exchanges a native asset from one chain to a native asset from another chain, with a memorandum, an outgoing address, and a switch that can be turned off by a two-thirds majority. The counter-question hides the intermediary function within the settlement layer.
The capital path separates bridge fees from governance costs. About 85% of the stolen funds in the Bybit case moved from ETH to BTC, while in the Bitget case, XRP and BNB also used the same exit. The validator bonds and forfeiture mechanisms are used to prevent nodes from stealing from their own pools, not to refuse known external stolen funds. The motivation is to maintain traffic for "any address can exchange"; the strategy is to push the cost of scrutiny onto public chains while keeping revenue within RUNE incentives.
Analogies include mixers being rebranded as "just smart contracts" after being named, and the rapid overturning of suspension votes in the 2025 Bybit case. The industry phase has shifted from "stablecoin issuers must freeze" to "cross-chain validators choose whether to freeze or not." The ability to automatically halt its own stolen chain, yet treating external stolen funds as equivalent to Bitcoin's routing bytes, indicates that the switch obeys treasury risk, not industry recourse.
Structural judgment belongs to the transfer of pricing power under regulatory changes. The contention is over "who has the right to act as a filter." The mechanism is: public chains only keep accounts, while cross-chain protocols keep accounts and facilitate exchanges; once exchanges are defined as permissionless and equivalent to Bitcoin, the filter disappears from the protocol layer, leaving only the issuer able to freeze stablecoins still in the contract. Thus, the pricing power of stolen funds shifts from the hacked exchanges to the bridges that remain open.
ABAB News · Law of Cognition
Those who can halt their own treasury should not compare themselves to public chains that only keep accounts.
If permissionless equals not intercepting known stolen funds, bridge fees become a tax on stolen funds.
The switch is only pressed when one is bleeding; neutrality is selective income protection.