Decentralized Logic vs. Centralized Control
On September 28, 2026, the decentralized protocol THORChain declined a formal request from exchange Bitget. The exchange asked the network to block specific addresses linked to a massive hack. This occurred while approximately $6 million in assets moved to Bitcoin. The incident highlights the tension between centralized exchanges and decentralized infrastructure. The total value of the stolen funds is estimated at $387.5 million.
Breaking news
Fitch says power, not chips, will decide Taiwan’s AI data centre growth
Vitalik Buterin Warns AI Could Break Crypto Math Sooner Than Quantum Computers
Justin Drake Calls for „Bunker Mode” Migration to New Crypto Addresses
XRP Eyes $2 Breakout, Analyst Highlights Key ResistanceBitget urged THORChain to stop serving requests from the addresses tied to the theft. However, the protocol maintained its operational stance during the critical window. Analysts noted that the network continued processing transactions normally. This decision allowed the hackers to execute their plan without interruption. The refusal to block the addresses was a key factor in the asset movement.
The core issue lies in how THORChain handles user requests. As a decentralized application, it generally does not have a central authority to pause operations. Blocking an address requires consensus among the network’s nodes. Bitget wanted a temporary freeze to prevent further losses. The protocol prioritized its standard operating procedures over the exchange’s emergency plea. This approach ensures fairness but offers less flexibility during crises. Critics argue that this rigidity benefits sophisticated attackers who understand the code.
Why Did the Protocol Ignore the Exchange?
CoinDesk analysis revealed the specific mechanics of the transfer. Investigators identified twenty-seven successful swap transactions. These swaps converted roughly 2,390 Ethereum tokens into 75.2 Bitcoin. The conversion process took place while the dispute was active. By moving assets to Bitcoin, the hackers likely sought greater liquidity or anonymity. Bitcoin remains the most widely accepted cryptocurrency for off-ramping. This move suggests the attackers were preparing to exit the crypto ecosystem.
THORChain operates on a trustless model where code executes automatically. No single entity can unilaterally halt the chain without community agreement. Bitget’s request was essentially a proposal to change behavior temporarily. The network’s developers and node operators evaluated the request against their protocols. They determined that blocking addresses could introduce complexity or bugs. Therefore, they chose to let the system run as designed. This decision reflects a broader philosophy in DeFi. It favors transparency and predictability over reactive interventions.
The financial impact on Bitget remains significant. The exchange now holds a large liability from the stolen funds. Users who deposited assets with Bitget may face delays in withdrawals. The $387.5 million figure represents one of the larger hacks in recent memory. The subsequent $6 million shift to Bitcoin adds another layer of complexity. Traders are watching closely to see if the Bitcoin moves to other chains.
Frequently Asked Questions
How much money did the hackers convert to Bitcoin? The hackers successfully swapped approximately 2,390 Ethereum tokens. This transaction resulted in the acquisition of 75.2 Bitcoin. The total value of this specific transfer was around $6 million.
Why didn't THORChain block the hacker addresses immediately? The protocol follows a decentralized structure that avoids unilateral pauses. Blocking addresses requires broad consensus among network nodes. THORChain preferred maintaining standard operations to ensure network stability.
What is the total value of the theft? The initial exploit resulted in a loss of $387.5 million. This amount represents the primary financial damage to the affected parties. The subsequent movements of funds do not change the initial theft total.
