Bitget Requests THORChain to Block Addresses Following Major Cross-Chain Hack

This incident underscores vulnerabilities in decentralized finance (DeFi) systems and the challenges of asset recovery across multiple blockchains.

• Bitget experienced a $387.5 million breach on September 24, 2026, affecting eight different blockchains.
• THORChain declined Bitget's request to block transactions linked to the hacker, citing its permissionless design.
• Stablecoin issuers Circle and Tether froze approximately $318,013 of the stolen funds, representing only 0.082% of the total loss.

• The breach was part of a trend of sophisticated attacks targeting exchange hot wallets, enabling rapid asset movement across chains.
• THORChain had previously halted its network in May 2026 after a $10.7 million exploit, showcasing its emergency capabilities but also its limitations in selective freezes.
• The rise of cross-chain liquidity and laundering techniques complicates recovery efforts, as stolen assets can quickly move beyond the control of issuers.

On September 24, 2026, Bitget detected unauthorized transfers from its hot wallet, leading to the loss of approximately $387.5 million across eight blockchains, including Ethereum and TRON. This breach was executed through sophisticated social engineering tactics, allowing the attacker to compromise the exchange's security and rapidly move funds across multiple chains.

Bitget's CEO, Gracy Chen, publicly requested that THORChain block any transactions linked to the hacker's addresses on September 28. However, THORChain responded by emphasizing its permissionless nature, which prevents selective freezing of addresses. Instead, it highlighted its ability to halt the entire network in emergencies, akin to how base chains like Bitcoin operate. This response illustrates a fundamental tension in decentralized finance: while protocols like THORChain aim to maintain integrity and decentralization, they also face pressure to respond to security breaches in a way that protects users.

In the aftermath, stablecoin issuers Circle and Tether managed to freeze a small fraction of the stolen assets—around $318,013—representing only 0.082% of the total loss. This limited recovery underscores the challenges faced by exchanges and issuers in tracking and reclaiming stolen funds once they traverse multiple chains. The funds were traced to THORChain before being routed to Bitcoin and mixed using CoinJoin techniques, further complicating recovery efforts.

Bitget has since resumed certain withdrawals and reassured users that their balances are protected by a fund exceeding $464 million. However, the incident has raised questions about the effectiveness of current recovery mechanisms in decentralized networks and the responsibilities of exchanges and protocols in safeguarding user assets.

• Cryptocurrency exchanges: Increased scrutiny on security measures and compliance protocols.
• Traders and investors: Potential for heightened compliance requirements and asset recovery challenges.
• Regulatory bodies: Pressure to establish clearer guidelines for asset recovery in decentralized finance.
• Local crypto firms in Dubai: May face intensified compliance scrutiny on cross-chain transactions.

• Increased compliance measures: Watch for exchanges and protocols enhancing KYC and AML processes in response to this incident.
• Future regulatory actions: Monitor for potential regulatory frameworks aimed at improving asset recovery in decentralized finance.
• Market reactions: Observe how market participants adjust their strategies in light of heightened security concerns and compliance requirements.