Evidence at a glance: Bitgets loss figure comes from its September 25 statement. The dispute is described in September 27 reporting; technical claims about halt controls are checked against THORChain documentation.
The Bitget hack has created a much larger argument than whether one protocol should blacklist one wallet. It has exposed a core distinction between permissionless operation and the technical ability to intervene. Bitget said that approximately $387.5 million had been transferred to attacker-controlled addresses during its September 24 security incident. Its September 25 update said the upward revision reflected more complete accounting, not additional theft. Bitgets statement
September 27 reporting described a dispute over routing funds associated with the incident through THORChain. It reported that Bitget sought intervention, THORChain defended permissionless operation, and OKX founder Star Xu challenged the comparison with Bitcoin. These positions are attributed to that reporting. Dispute coverage A separate, verifiable technical question is whether THORChain has operational controls for emergencies. The protocols own documentation confirms that such controls exist. The dispute raises a concrete governance question:
If a protocol can stop, but chooses not to stop, is that censorship resistance — or a governance decision？
THORChain Is Not Architecturally the Same as Bitcoin
Bitcoins base-layer consensus does not require a protocol-level shared vault for cross-chain customer assets. THORChain does. THORChain enables native cross-chain swaps by managing assets inside threshold-signature vaults. Node operators jointly participate in the signing process required to move those assets. That architecture allows native cross-chain swaps without wrapping every asset. It also creates a different control surface. The question is no longer only whether validators can censor an inbound transaction. It includes whether validators can halt signing from shared vaults.
THORChains own emergency documentation says they can.
Source: THORChain: May 2026 exploit report.
THORChain Has Explicit Emergency Controls
THORChain documentation describes several response mechanisms. A single node can issue a make pause command that pauses the network for roughly 720 blocks, or about one hour. Additional nodes can extend the pause. Operational Mimir parameters can halt trading, signing or specific chains when enough node votes are reached. These controls exist for a reason. THORChain used them during its May 15, 2026 exploit. A malicious validator exploited weaknesses in the GG20 threshold-signature implementation and drained roughly $10.7 million from one vault.
THORChain‘s automatic solvency system reacted within minutes. Node operators then stacked manual pauses and governance votes. The protocol says the entire network reached a controlled halt within roughly two hours of the community raising the alarm. THORChain’s incident report That history makes the Bitget debate more complicated. THORChain is clearly capable of coordinated intervention. The open question is when it should use that capability.
Source: THORChain: Emergency procedures.
The Protocol‘s Argument Is About Neutrality
THORChain’s position is conceptually simple. Permissionless infrastructure should not decide which users are legitimate. If a wallet can produce a valid transaction, the protocol should process it. Otherwise, the network becomes a compliance intermediary rather than neutral infrastructure. This is similar to the strongest censorship-resistance argument around Bitcoin. The problem is that THORChain already has governance and vault controls that Bitcoin does not have in the same form. That means the protocol is not merely refusing to add a new censorship function.
The existence of halt controls makes non-intervention a governance question. It does not establish that a safe, ready-made address-blocking mechanism is available. Those are different claims.
Bitgets Argument Is About Responsibility
The responsibility argument can be stated without assuming a specific intervention would be safe. Critics argue that infrastructure operators should examine feasible interventions when addresses are linked to theft. Whether fees motivate any particular decision cannot be established merely from the protocol earning fees. This argument becomes stronger when the protocol has previously paused to protect its own vaults. Critics therefore describe the stance as asymmetric:
intervention when THORChain funds are at risk; neutrality when another platforms funds are stolen.
That criticism is politically powerful. It does not automatically mean targeted censorship is technically safe or governance-neutral.
Targeted Blocking Is Harder Than a Global Pause
One important technical distinction is often lost in the debate. Stopping the entire network is not the same as blocking one address. A global pause is a blunt safety control. Targeted transaction censorship requires validators to agree on:
- which addresses are blocked;
- who maintains the list;
- what standard of evidence is sufficient;
- when a block expires;
- what happens when attackers rotate addresses;
- how false positives are handled.
That is a much more durable governance commitment. Once the network creates a wallet blacklist for theft, it has to answer whether it will do the same for sanctions, court orders, fraud claims or political pressure. The architecture may support intervention. The policy is still difficult.
Why the Bitget Funds Matter
The immediate questions for affected users differ from the governance debate: what the exchange has confirmed, what has actually been recovered, and which services are available. Bitget announced on September 26 a phased withdrawal-restoration plan starting September 28. A published schedule is not proof that every asset and network is already available. Users need the latest official service status for their specific asset. Restoration announcement
For infrastructure analysis, the episode raises a broader question: which intervention powers exist, and what evidence and procedures justify using them？ The amount routed through a single protocol should not be assumed to equal the exchanges total reported loss.
WikiBit Analysis: Why It Matters
This debate should change how “decentralization” is analyzed. A protocol should not be described as decentralized simply because no company can unilaterally freeze an account. The more useful framework is:
- Who controls shared assets？
- Who can halt execution？
- Who can change protocol parameters？
- How many actors are needed？
- Can controls target one chain or one wallet？
- Has the network used these powers before？
- Bitget recovery efforts;
- additional hacker flows;
- RUNE fee and volume data;
- validator public statements;
- regulatory reaction;
- future emergency-control documentation.
- Bitget: September 25 incident and fund-tracing update
- THORChain: Emergency procedures
- THORChain: May 2026 exploit report
- CryptoCompass: September 27 reporting on the block request and response
- Bitget: Announced phased withdrawal resumption
THORChain and Bitcoin have different control structures on several of those dimensions. That does not automatically make THORChain centralized. It means decentralization is multidimensional.
The Economic Incentive Problem
The debate also contains an uncomfortable economic layer. High-volume stolen-fund routing can generate fees for a cross-chain liquidity network. That creates a perception problem even if validators are acting from a principled neutrality position. If the protocol earns more during illicit routing, outsiders can interpret non-intervention as financially motivated. The only way to reduce that suspicion is transparent governance and clear policy before the next incident.
Risks and Counterarguments
Blocking stolen funds is not operationally simple. Onchain attribution can be wrong. Attackers split and rotate wallets. Protocols can be pressured by governments to extend blacklists beyond clear theft cases. Targeted censorship may create legal and governance liability for validators. THORChains permissionless stance therefore has a legitimate philosophical basis. At the same time, comparing THORChain directly with Bitcoin ignores real architectural differences, including shared vaults and emergency signing controls.
What to Watch Next
Watch whether THORChain node operators propose any Mimir changes or formal policy around known stolen funds. Also watch:
The most useful long-term question is not: “Is THORChain decentralized？” It is:
Which intervention powers exist, and under what conditions will the network use them？
FAQ
Did THORChain block the Bitget hacker？
September 27 reporting described THORChain as rejecting the request. This article does not claim an independent, live audit of transaction filtering. Dispute coverage
Can THORChain pause？
Yes. Its documentation includes network pause, trading halt and signing-halt mechanisms.
Has THORChain used those controls before？
Yes. During its May 2026 vault exploit, automatic systems and node operators brought the network to a controlled halt.
Is THORChain the same as Bitcoin？
No. Both are permissionless systems, but THORChain uses shared threshold-signature vaults and has explicit operational halt controls.
Why is this debate important？
It forces the industry to distinguish technical decentralization from governance choices about censorship and recovery.
Sources
WikiBit Research Briefing provides source-attributed analysis of current developments in crypto. Technical proposals, allegations and analyst estimates are identified as such. This article is informational and does not recommend a trade.