Slow Mist Founder Yu Xian: THORChain's Double Standards on Stolen Funds
Yu Xian, founder of Slow Mist, stated that the Bitget hack is a widely publicized, significant event with clear characteristics, and the funds quickly traced back to North Korean hacker paths. Circle and Tether have promptly frozen the relevant stablecoins, especially Circle, which froze the USDC held by the hacker. He criticized THORChain for quickly intervening when it was hacked but comparing itself to Bitcoin and Ethereum in major industry cases, claiming it has no right to interfere while continuing to charge high cross-chain fees.
Bitget discovered unauthorized transfers from its hot and warm wallets on September 24 at 18:31 UTC, initially estimating losses at approximately $351.6 million, later revised to about $387.5 million, including around 103 million XRP. The attacker compromised the wallet backend, forged transaction data, and tricked the authorization process, but the private keys were not stolen. The CEO mentioned that some IPs overlapped with those commonly used by North Korean organizations' VPNs, and on-chain analysis firms linked some addresses to existing North Korean attribution clusters associated with Bybit and AFX.
Circle blacklisted one attack address around 05:00 UTC the next day, freezing approximately 99,990 USDC; Tether subsequently froze about 218,000 to 239,000 USDT, totaling around $318,000. During the same period, a large amount of stablecoins was exchanged for ETH. TRM and Bitquery indicated that BNB, TRX, and some XRP were exchanged for Bitcoin via THORChain, with early statistics showing over 126 BTC exchanged.
Bitget publicly listed the attack addresses and formally requested THORChain to deny services to these addresses, stating that decentralization should not greenlight known stolen funds. THORChain responded that its protocol, like Bitcoin and Ethereum, does not require permission and cannot solely bear the responsibility for scrutiny. On-chain records show a large amount of XRP was deposited in batches into the THORChain treasury, with memos specifying exchanges for Bitcoin. On September 25, the protocol's fee income was approximately $381,700, marking a five-month high.
THORChain has been attacked in both 2021 and May 2026, with nodes pausing exchanges and upgrading. Bitget stated that the cold wallet was unaffected, and a $464 million user protection fund covers the losses, while requesting assistance from Mandiant and Slow Mist for the investigation, offering a 5% bounty for freezing and recovering funds.
In market mechanics, the purchase is a "escape route to quickly exchange frozen assets for native BTC," while the sale is permissionless cross-chain depth. Funds flow from the exchange's hot wallet to Bitcoin addresses unreachable by the stablecoin issuers' blacklist; fees enter THORChain nodes and liquidity providers. Beneficiaries are attackers who can complete exchanges before the freezing window closes and the fee-charging protocol; under pressure are issuers of frozen stablecoins unable to stop the main path, and exchanges that must use the protection fund to cover losses. This is a competition for event-driven liquidation channels, not ordinary trading volume fluctuations.
Source: Public Information
ABAB AI Insight
Slow Mist was invited by Bitget to join the investigation team, and Yu Xian's remarks are not mere observations but rather a redefinition of "who should hit the pause button" from a moral issue to a governance record comparison: the same set of validators can pause the chain and fix code when their treasury is attacked, but when stolen funds bridge through external exchanges, they claim to have no authority to scrutinize. The comparison is not about the ideal of decentralization, but the fact that the switch has been pressed before.
The capital path shows that fees and stolen funds flow into the same pool. The attackers' end goal is native Bitcoin without an issuer; THORChain provides depth for unwrapped assets and without KYC. Circle and Tether can only freeze the leftover amounts that attackers couldn't exchange in time, while the main paths of XRP and BNB have already turned into BTC. The protocol's revenue reached a five-month high the day after the incident, indicating that "major industry events" serve as traffic for permissionless bridges, not crises.
Comparative cases include the $1.2 billion stolen from Bybit that was relocated through similar cross-chain channels, and the stance shifts of mixers before and after sanctions. The industry phase has shifted from "stablecoin issuers can freeze, thus safe" to "freezing is only effective for tokens still in contracts." THORChain compares itself to Bitcoin to push the cost of scrutiny onto the entire network while keeping the bridge fees on its own books.
Structural judgment belongs to the collision of regulatory changes with the reconstruction of the industrial chain. The stablecoin layer is required to cooperate with law enforcement, while the cross-chain exchange layer uses permissionless mechanisms to extricate itself from being a law enforcement target. The mechanism is: once assets leave a freezeable contract and enter the native coin liquidity pool, the right to reclaim shifts from the issuer to node voting; nodes only vote to pause when their own treasury is harmed, while external stolen funds become fees. Decentralization here does not treat all transactions equally but selectively shuts down its own risks while opening up others' risks.
ABAB News · Cognitive Laws
Can stop its own chain but cannot stop passing stolen funds, indicating that the charging rights are not neutral.
Stablecoins can only freeze the leftover amounts that hackers couldn't exchange in time.
Permissionless bridges turn sanctions into fee periods.