Nach Bitget Hack: Darum entbrennt ein Streit über den DEX Thorchain

Bitget Hack: Attackers secure loot

The well-known cryptocurrency exchange Bitget discovered unauthorized access to its wallets last Thursday. Unauthorized individuals managed to steal cryptocurrencies worth approximately 357 million US dollars.

The stolen cryptocurrencies include XRP , Ethereum , and other well-known coins. The hackers converted large portions of their loot into ETH shortly after the incident. They hope to use the Ethereum blockchain to securely transfer the funds without encountering any security measures.

Stablecoin operators Circle and Tether reacted quickly to the hack and froze the stolen tokens. However, this only amounts to a six-figure sum, which is negligible compared to the total value of the stolen tokens.

Security experts from SlowMist revealed last Friday that the unknown hackers used the Thorchain service to exchange the stolen cryptocurrencies for other coins – including the aforementioned exchange of various coins for Ethereum.

According to Bitget and independent blockchain analysts, the North Korean state-run hacking group Lazarus is behind the incident. Lazarus reportedly managed to infiltrate Bitget and thus gain access to hot and warm wallets.

After a temporary shutdown, the crypto exchange is resuming its functions today . The final steps are expected to be completed on October 2nd.

That’s why a dispute is now breaking out over the DEX Thorchain.

The Bitget hack is now causing a domino effect. A dispute is raging within the industry and the crypto community over the decentralized cryptocurrency exchange Thorchain. The DEX processed the hackers‘ transactions, thus enabling them to transfer the stolen funds.

Bitget and SlowMist are therefore accusing Thorchain of failing to adequately respond to early reports from Bitget’s IT security team. This same debate has been resurfaced several times in the past following similar incidents. For example, in the spring of 2025, hackers stole approximately $1.5 billion in cryptocurrency from the Bybit trading platform.

Lazarus is also believed to be behind this incident. The loot was transported in a similar manner. The hackers also used Thorchain at the time. This DEX allows users to exchange coins that are easier to protect against countermeasures. ETH is particularly popular for this purpose. At the same time, the exchange can help to conceal the cryptocurrencies.

“Today, following another serious security incident at Bitget, we are once again observing funds being transferred by attackers to Thorchain to carry out swaps and cross-blockchain transfers,” wrote SlowMist, referring to the Bybit hack last week.

THORChain and Stolen Funds: The Industry Needs Answers

After the $1.46B @Bybit_Official hack last year, nearly $1.2B in stolen funds was reportedly traced through @THORChain as the attackers moved assets across chains.

Today, following another major security incident at @Bitget…

— MistTrack🕵️ (@MistTrack_io) September 25, 2026

SlowMist therefore attributes a large share of the blame for the success of the hack to Thorchain. The security experts expect interventions once it is known that the exchanged funds originated from illegal sources.

“The attackers‘ addresses have already been publicly identified and are being actively monitored by (…) the entire crypto industry.”

The problem: Thorchain relies on a decentralized, permissionless system. In practice, this means that anyone can exchange cryptocurrencies at any time – regardless of their background.

The DEX thus adheres to the fundamental principles of cryptocurrencies, which are committed to neutrality. As soon as censorship is possible in any form, it can be expanded indefinitely. Therefore, censorship is generally frowned upon in the crypto scene.

“Decentralization should not become a blanket excuse when it comes to known stolen funds,” SlowMist further argues.

Why Thorchain doesn’t freeze cryptocurrencies

Thorchain’s technical design does not allow for the freezing of specific funds. In the past, the DEX has repeatedly responded to large hacks to prevent the transfer of the stolen money.

However, the network operators must reach a consensus and shut down the network together. This only temporarily restricts hackers, not permanently. Shutting down the front ends is easier. For example, the operators of Thorswap can simply take their portal offline. Hackers can then potentially continue to trade via Thorchain by using a different frontend.

DEX responded to the allegations of the past few days via its official X-branding campaign . It denied the accusations of wrongdoing.

“THORChain is decentralized and permissionless, just like Bitcoin , Ethereum, and the BNB Chain.”

A THORChain network halt is an emergency security mechanism designed to protect the protocol.

A halt is not a selective freeze of specific funds or an individual swap.

During the May 2026 exploit that resulted in $10.7M stolen from the liquidity pools, the attackers addresses… https://t.co/HrigTUbA4Q

— THORChain (@THORChain) September 28, 2026

When Thorchain itself became the target of an attack in May 2026 , the service was therefore unable to seize its own funds. The developers fear that Bitget now wants to shift the blame for its own mistakes onto DEX.

Participants in the Thorchain network profit from every exchange because fees are charged for it. Currently, various voices are calling for the return of the funds collected to Bitget.