Bitget Hack Fallout Sparks Debate Over THORChain’s Decentralization
OKX founder Star Xu disputed THORChain's description of itself as fully decentralized after assets from a Bitget breach were reportedly routed through its cross-chain system. Bitget now estimates the stolen amount at about $387.5 million, up from an earlier $351.6 million, and has asked for help blocking the attacker. The exchange plans to resume Bitcoin withdrawals on Sept. 28, followed by ETH and USDT, with other services later.
Bitget first noticed unauthorized hot-wallet transfers on Sept. 24 at 18:31 UTC. Its initial tally was $351.6 million, later revised to $387.5 million after Zcash and Tron movements were added. Cold storage stayed safe, and the exchange said its protection fund exceeded $464 million. Mandiant and SlowMist joined the inquiry.
Withdrawal restoration is staggered: Bitcoin on Sept. 28, ETH on Sept. 29, USDT on Sept. 30, then other tokens, fiat and P2P on Oct. 2. Bitget CEO Gracy Chen urged THORChain to block attacker-linked addresses. THORChain maintained its permissionless system cannot single out users, while Star Xu argued validator threshold signing gives an intermediary-like custody role.
The dispute may shape how users and builders judge cross-chain security and decentralization claims. If exchanges seek to block funds, it could intensify tension between permissionless protocols and recovery efforts, potentially affecting compliance expectations. Traders awaiting withdrawals may face delayed access, while stablecoin freezes show issuers can sometimes immobilize stolen tokens. Broader confidence in crypto intermediaries and DeFi governance could shift, though the outcome remains uncertain.