THORChain Faces Fresh Questions Over Bitget Exploiter Funds and Cross-Chain Swaps
THORChain is facing renewed scrutiny over its role in moving cryptocurrency linked to major hacks after blockchain intelligence firm MistTrack alleged that funds associated with a recent Bitget exploit were sent through the cross-chain protocol.
MistTrack said on September 25 that it was observing funds attributed to the Bitget exploiter being routed through THORChain for asset swaps and cross-chain transfers. The company argued that the incident raises broader questions about how decentralized protocols should handle cryptocurrency that has already been publicly identified as stolen.
The claims come months after the $1.46 billion Bybit hack, during which blockchain investigators tracked a large amount of stolen cryptocurrency through different networks and services. MistTrack said nearly $1.2 billion of the stolen funds was reportedly traced through THORChain as the attackers moved assets across chains.
MistTrack Questions THORChain’s Role
MistTrack’s latest post focused on whether a permissionless cross-chain protocol should take action when funds entering its system have already been publicly associated with a major exploit. The blockchain intelligence company said attacker addresses involved in the Bitget incident had been flagged and were being monitored by exchanges and blockchain security and anti-money-laundering firms.
The company questioned whether decentralization should prevent protocols from responding when transactions involve funds identified as proceeds from major hacks. MistTrack specifically pointed to cross-chain routes such as ETH to BTC and BNB to BTC as examples of how stolen assets can potentially be converted and moved between networks.
Related: Bitget Reports $351.6M Security Incident as XRP Suffers Largest Single-Chain Loss
The allegations do not, by themselves, establish that THORChain operators knowingly approved or controlled the specific transactions described by MistTrack. THORChain operates as a decentralized and permissionless protocol, meaning transactions are processed according to its network rules rather than through a conventional centralized exchange’s manual approval system.
THORChain responded directly to the criticism, drawing a comparison with major permissionless blockchain networks. In its September 26 response, the protocol said it was “decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain” and asked what responsibility those networks should bear when handling known stolen funds.
The response highlights the central issue in the dispute: the difference between infrastructure that processes transactions according to protocol rules and centralized businesses that can potentially freeze accounts or block transactions based on compliance and risk assessments.
The Bigger Challenge for Cross-Chain Infrastructure
Bitget has separately thanked blockchain security firm SlowMist for its efforts to track and recover funds connected with the recent exploit. This indicates that security companies and exchanges are actively monitoring the movement of assets associated with the incident.
For cross-chain protocols, stolen funds create a particularly difficult problem because assets can move rapidly between blockchains and be exchanged for different cryptocurrencies. Once funds leave a centralized platform, investigators can follow the on-chain trail, but stopping the movement can depend on the design and governance of each protocol involved.
THORChain’s model is particularly relevant because its infrastructure is designed to facilitate native asset swaps across different blockchain networks. Unlike a centralized exchange, there is no conventional account-management system through which a user can simply be suspended after a transaction is identified as suspicious.
The controversy therefore extends beyond THORChain and raises questions about the responsibilities of decentralized infrastructure more broadly. If permissionless protocols can be used to move hacked assets, regulators, exchanges and security firms may increasingly examine how those systems interact with anti-money-laundering efforts.
Related: SingularityNET Confirms Security Breach as Attacker Mints Unauthorized AGIX, NTX and Other Tokens
At the same time, imposing transaction-level restrictions on decentralized protocols can create technical and governance questions of its own. Measures designed to block known illicit funds could potentially require changes to validators, node operators, interfaces or other components of the ecosystem, depending on the protocol.
The Bitget-related allegations also demonstrate why attribution matters in blockchain investigations. Addresses can be publicly labeled as belonging to an exploiter by security companies, but determining who controls an address, whether funds were directly stolen and whether a particular protocol knowingly facilitated their movement can require additional evidence.
For now, MistTrack is calling attention to the movement of funds and questioning THORChain’s responsibilities, while THORChain maintains that its decentralized and permissionless architecture should be considered alongside the broader principles governing networks such as Bitcoin, Ethereum and BNB Chain.
The dispute is likely to keep the focus on one of crypto’s unresolved questions: how decentralized financial infrastructure can remain permissionless while the industry attempts to prevent publicly identified stolen assets from being converted, transferred and moved across multiple blockchain networks.
About The Author
