THORChain responded to criticisms from the on-chain tracking platform MistTrack regarding its repeated use for transferring stolen funds from Bybit and Bitget, expressing sorrow over the recent exchange attacks. It emphasized that it is a decentralized and permissionless protocol like Bitcoin, Ethereum, and BNB Chain, and questioned what responsibility these three chains should bear when handling known stolen funds.

MistTrack pointed out that the funds from the Bitget attacker were exchanged through THORChain; in last year's theft of approximately $1.46 billion from Bybit, nearly $1.2 billion was also exchanged through the same protocol from ETH to BTC. The platform believes that "decentralization" cannot automatically serve as a disclaimer for handling known stolen funds, specifically naming paths such as ETH to BTC and BNB to BTC.

After Bitget revised its losses to approximately $387.5 million, the CEO publicly listed the attack addresses and formally requested THORChain to refuse service, stating that decentralization should not greenlight known stolen funds. The protocol did not initiate a new chain halt vote against the Bitget addresses. During the Bybit incident in 2025, three validators voted to suspend ETH trading, which was overturned by four votes within minutes, leading to the resignation of core developers.

THORChain has the capability to halt operations: after approximately $10.7 million was transferred from its treasury by a newly joined node exploiting a threshold signature vulnerability in May 2026, the payment detection automatically stopped multi-chain signatures and transactions within about 52 minutes, leading to a network suspension of approximately 39 days. Nodes are required to stake a large amount of RUNE, and a two-thirds majority can suspend trading.

Circle and Tether have frozen approximately $318,000 in stablecoins at the attack addresses; XRP, BNB, and TRX on the THORChain path were exchanged for Bitcoin. On September 25, the protocol's fee income was approximately $381,700, the highest in nearly five months.

In market mechanisms, the narrative bought is "equating protocol responsibility with public chain neutrality," while the sell is for permissionless native asset exchanges. Funds from the named exchanges' hot wallets enter the THORChain treasury and then flow out as BTC; fees go to nodes and liquidity providers. Beneficiaries are validators continuing to handle large bridge orders; those under pressure are the publicly named addresses, exchanges demanding service refusal, and tracking platforms. This is a struggle over governance will, not a technical dispute over interception capabilities.

Source: Public Information