THORChain Faces Scrutiny After Refusing to Block $387.5M…

Published: September 30, 2026 – 16:21 UTC

Why Did THORChain Refuse Bitget’s Request?

The $387.5 million Bitget hack has opened a harder debate than simply tracing the stolen crypto: whether decentralized protocols should stop processing funds once investigators have publicly linked them to a theft.Bitget CEO Gracy Chen asked THORChain to refuse transactions from addresses associated with the attackers after investigators traced stolen assets moving across blockchains. THORChain rejected the request, arguing that it operates as a decentralized and permissionless network in the same way that Bitcoin or Ethereum does.“THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?” the protocol said.The response revived questions about THORChain’s role in moving illicit funds. The protocol was previously used to swap about $1.2 billion connected to the 2025 Bybit hack, an issue recently examined in research challenging how decentralization applies to THORChain-linked fund flows.THORChain retired its admin key shortly before the Bybit theft, limiting the ability of any central operator to unilaterally block individual addresses. That makes selective censorship technically and governance-wise different from temporarily halting a protocol during an emergency.

Why Did NEAR Intents Take The Opposite Approach?

NEAR Intents responded very differently. Its automated SHIELD system detected addresses linked to the Bitget attack and blocked attempts to route more than $50 million through its cross-chain infrastructure.NEAR Intents also froze roughly $503,000 that entered the system, while about $166,000 passed through before restrictions took effect. FinanceFeeds previously detailed how SHIELD intercepted the Bitget-linked transfers.The protocol even declined Bitget’s proposed 5% recovery bounty, framing the intervention as part of its normal security architecture rather than a paid recovery service.That response earned praise from Bitget but criticism from crypto users who argue that infrastructure capable of rejecting specific addresses cannot be described as fully permissionless.The disagreement therefore reaches beyond one hack. THORChain prioritizes censorship resistance even when stolen assets are involved. NEAR Intents has built automated controls that intentionally sacrifice some of that openness when its systems identify funds connected to hacks or illicit activity.

Investor Takeaway

The Bitget case exposes a trade-off DeFi projects can no longer treat as theoretical. Greater control can help stop stolen funds, but the ability to intervene may also create expectations from regulators, users and courts that the same controls should be used in other cases.

Can Intervention Create More Legal Responsibility?

Yuriy Brisov of D&A Partners argues that control can become legally important. A protocol that proves it can selectively interfere with transactions may find it harder to argue in future disputes that it has no ability or responsibility to police activity on its network.“If you show that you have control over assets, then you potentially open yourself to all potential claims,” Brisov said.His argument does not mean that blocking stolen funds automatically makes a protocol legally responsible for every transaction. The regulatory treatment of decentralized software remains jurisdiction-dependent and fact-specific. But the degree of operational control can affect how regulators and courts assess the role of developers, operators and governance participants.Automated systems may complicate that analysis further. NEAR’s SHIELD does not depend on a compliance employee manually approving every blocked transaction. It screens addresses automatically using information associated with hacks and other illicit activity.Brisov argues that automated controls offer a stronger decentralization case than a team manually deciding which transactions should proceed.

Is Permissionless DeFi Becoming Harder To Defend?

The Bitget dispute shows why cross-chain infrastructure is becoming a focal point in crypto enforcement. Stolen assets can move from one blockchain to another without passing through a centralized exchange that can freeze an account, but the transactions remain publicly traceable.That creates pressure on protocols sitting between chains. If they can intervene, exchanges and regulators may increasingly ask them to do so. If they cannot, they risk becoming preferred routes for hackers attempting to convert stolen assets.The debate also touches legal questions raised by cases involving decentralized protocols and immutable smart contracts. FinanceFeeds has previously covered the legal fight surrounding Tornado Cash and responsibility for illicit crypto flows, where questions of control over software became central to arguments about liability.THORChain and NEAR Intents now represent two very different answers to the same problem. One argues that permissionless infrastructure should process transactions without deciding who deserves access. The other argues that automated safeguards can block known stolen funds without turning a decentralized protocol into a traditional financial intermediary.Neither approach removes the risk. The Bitget hack instead shows that the next major DeFi battle may be about who has the technical power to stop stolen crypto — and what legal obligations may follow once that power exists.

Source: FinanceFeeds