A hacker moves stolen funds through THORChain. @bitget asks the network to block the identified addresses. @THORChain refuses. Behind ~$6.3M swapped from $ETH to $BTC lies a much bigger question: Should permissionless infrastructure decide who is allowed to use it? A thread 🧵👇 -- 1️⃣ 🔎 What happened? On September 24, Bitget detected unauthorized transfers from its hot and warm wallet infrastructure. The exchange later revised the total affected amount to approximately $387.5M. Some of those funds eventually reached THORChain. -- 2️⃣ ⚡ The THORChain route According to CoinDesk's analysis of public THORChain transaction records: 27 successful swaps converted roughly: 2,390 ETH ↓ 75.2 BTC Worth approximately $6.3M at the time. The BTC outputs went to a single address. -- 3️⃣ 🚫 Bitget asked for intervention Bitget publicly identified attacker addresses and asked THORChain to refuse service to them. THORChain rejected selective blacklisting. That distinction matters. Because THORChain does have emergency controls. Just not in the form Bitget requested. -- 4️⃣ 🛑 A halt is not a blacklist THORChain node operators can coordinate emergency actions through Mimir. Trading can be halted. Signing can be halted. Trading, signing, or an entire connected chain can be halted. The network can even halt trading globally. But these controls affect entire categories of activity. They are not simply: “Block wallet X.” -- 5️⃣ ⚙️ This is an architectural question Imagine suspicious funds entering through Ethereum. Halting ETH trading could prevent further ETH swaps through that route. But it would also affect legitimate users trying to swap through Ethereum. That is very different from selectively refusing one address while allowing everyone else through. A circuit breaker is not the same thing as a blacklist. -- 6️⃣ 🧭 And that creates a difficult boundary If node operators begin deciding: “This address can swap.” “This one cannot.” They are no longer only validating protocol rules. They are also interpreting external claims and deciding who may access the infrastructure. Who provides the blacklist? Who verifies it? Which jurisdictions count? Who decides when an address is removed? -- 7️⃣ 🧭 Permissionless gets uncomfortable here No one needs to defend the hacker to understand the principle. If an exchange can ask decentralized infrastructure to stop transactions because of a security failure elsewhere, where should that power end? An exchange today. A government tomorrow. Another jurisdiction after that. And who decides which request is legitimate? -- 8️⃣ 🚪 Exceptions can become precedents There are situations where intervention may feel justified. But infrastructure rules are not written only for easy cases. Once selective censorship becomes an accepted response, every new incident creates another debate over who should be blocked, by whom, and according to which authority. An exception creates a precedent. A precedent can become an expectation. -- 9️⃣ ⚖️ Who should bear the cost? This question becomes even harder when intervention affects everyone. If THORChain halted Ethereum-related trading to respond to a security failure at an external exchange, legitimate THORChain users could lose access to that route too. Why should permissionless users bear the operational consequences of a security failure they did not cause? Protecting victims matters. So does avoiding new victims through collective restrictions. -- 🔟 🔐 Censorship resistance is tested at the edges Bitcoin made censorship resistance a foundational property of decentralized money. THORChain brings a related principle into cross-chain infrastructure: native assets moving through rules enforced by a distributed network rather than permissions granted case by case. That principle is easy to defend when everyone agrees with the transaction. Its real test begins when they do not. The Bitget incident exposes an uncomfortable trade-off: How do we respond to stolen funds without gradually turning decentralized infrastructure into another permissioned checkpoint? There may be no perfect answer. But the architecture we choose determines who gets the power to answer that question. Protecting people matters. But when protection requires restricting everyone, we should ask what else we are giving up. Freedom is rarely lost all at once. Sometimes, it disappears one reasonable exception at a time. 🔁❤️ RT and like to support decentralized cross-chain infrastructure 💬 Let’s discuss and move forward together toward a new decentralized world. #NDW #THORChain #CrossChain #validator thorchain:native