THORChain Kurs

$GRVT THORChain has come out to defend itself with a clarification that the emergency halt it initiated after its May 2026 $10.6 million exploit is not the same thing as the Bitget intervention request to prevent attackers from moving part of the $387.5 million stolen from the exchange through its platform.  The response is the latest episode in a standoff triggered by the year’s largest crypto hack after Bitget CEO Gracy Chen went public on September 26 with a formal request that THORChain refuse service to the publicly tracked attacker wallets, as Cryptopolitan reported.  Attackers used the same THORChain route after the Bybit hack, which was, ironically, also the largest security breach of 2025.  THORChain: A halt is not a freeze THORChain defended its decision not to go through with Bitget’s request by directing attention to important context it claims is being missed.  A network halt is “an emergency security mechanism designed to protect the protocol,” according to THORChain, and “is not a selective freeze of specific funds or an individual swap.”  The DEX clarified that during the May 2026 incident, in which it lost $10.7 million to hackers, it initiated a protocol-wide shutdown to contain the incident. Even then, it did not consider blacklisting the attacker’s addresses, and it would not do it now. Security firms poke holes at THORChain’s defense  GoPlus Security pushed back against THORChain’s defense comparing itself with base layers like Bitcoin and Ethereum, posting on September 27 that the protocol “has never been strictly decentralized” and telling it not to “enable criminals — or put the industry at risk — just to take swap fees on stolen funds.”  The blockchain security firm highlighted distinctions between THORChain’s threshold signature vaults and those of Bitcoin and Ethereum.  Longtime crypto security executive and THORChain supporter, Michael Perklin, backed up THORChain, calling out “AI slop” suspicion in the GoPlus comparison he considered “cherry picking at best, a false equivalency at worst.”  Perklin argued that threshold signing is an automated process, not a series of human approvals on individual transfers. “In all 3, there is no active choice to sign, only an active choice to turn off the machine,” he wrote, comparing a THORChain node operator’s options to a Bitcoin miner or Ethereum validator powering down.  Shutting the infrastructure to stop criminal transactions, he argued, would stop legitimate ones at the same time. THORChain itself made a similar case, questioning what responsibility Bitcoin, Ethereum, and BNB Chain should bear when they process transactions touching known stolen assets. Bitget is already moving on with a compensation plan The dispute plays out against an active recovery effort. Bitget suffered its breach on September 24, with the loss later revised up from $351.6 million to $388 million after transfers on Zcash and TRON were counted.  Fortune reported that Chen suspects North Korean attackers exploited a backend system to make fraudulent withdrawals look legitimate, without stealing private keys. The exchange’s investigation found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. As of this report, Chen stated that Bitget had processed 9,585 BTC withdrawals across the Bitcoin and BSC networks, totaling approximately 4,098 BTC after BTC withdrawals resumed on September 28. ETH withdrawals are scheduled to resume on September 29, USDT withdrawals on September 30, and other supported tokens, fiat and P2P services on October 2. Bitget says cybersecurity firms Mandiant and SlowMist are assisting, and it has launched a recovery-bounty program paying up to 5% for funds frozen or recovered, plus a live dashboard to track attacker wallets.  The exchange also points to its Protection Fund of 5,500 BTC, worth roughly $464 million, though the hack would consume a large share of it. If you're reading this, you’re already ahead. Stay there with our newsletter.

$RUNE 🔴 RUNE — Bearish Setup Current Price: $0.74 Entry: $0.735–$0.745 TP1: $0.720 TP2: $0.695 TP3: $0.665 SL: $0.765 Setup: 🔴 SELL / SHORT Risk: High Confirmation: Rejection below $0.745 supports the bearish setup. A break below $0.720 could accelerate the downside move. ⚠️ RUNE is volatile around this level, and recent market commentary has also identified $0.73 as an important momentum area. Verify the exact RUNE/USDT contract before entering.

$GRVT Cross-chain custody and censorship resistance collided with a high-profile breach narrative this week after Bitget publicly urged the decentralized liquidity protocol THORChain to block addresses allegedly tied to stolen funds. The dispute has reignited questions about what “decentralization” requires—and what it does not—when theft victims point to on-chain activity they believe is known to be malicious. The push began after Bitget reported unauthorized transfers that it later revised upward, with the exchange attributing the suspected actor to North Korea based on preliminary investigative signals. In response, THORChain’s stance—whether it can meaningfully blacklist the relevant addresses, and whether it should—has become the center of an argument that is now spilling beyond technical governance and into the broader ethics of permissionless networks. Key takeaways Bitget said unauthorized transfers rose from $351.6 million to $387.5 million, and later pointed to IP clues it believes link the activity to VPN infrastructure used by a North Korean hacking group. Bitget CEO Gracy Chen publicly asked THORChain to block addresses tied to the alleged theft connected to the Bybit-linked flow on THORChain. THORChain’s compliance position is unclear in practice because its ability to blacklist specific addresses has been questioned, including references to earlier admin-key changes. The debate is also exposing an asymmetry: decentralized funds may still be traceable after swaps, but protocols differ in whether they can or should exert address-level controls. While governance and security principles are at stake, THORChain has also faced criticism of its operational decentralization compared with networks like Bitcoin and Ethereum. Bitget’s breach claims and the “block the addresses” demand Bitget disclosed that it had detected “unauthorized transfers” tied to a security incident on September 25. According to Cointelegraph reporting, the exchange initially put the figure at $351.6 million, before updating it to $387.5 million. Bitget also stated that a preliminary investigation had linked IP addresses involved in the incident to VPN services associated with North Korean hacking operations, though the evidence was described as suggestive rather than definitive. Bitget CEO Gracy Chen publicly argued that decentralized protocols should not serve as a destination for funds connected to theft. She said decentralization is a design principle, not a shield for facilitating known stolen assets, and urged THORChain to block addresses it believed were tied to the incident. That framing matters because it reframes a typical “hack victim versus exchange” story into a “hack victim versus liquidity routing” story. If a stolen-flow path crosses a decentralized exchange-like venue, the conversation shifts from incident response alone to the network-level question of whether platforms can limit interaction with suspected addresses. Why THORChain is at the center of the argument As Bitget’s criticism spread, the broader context involved a prior major breach attributed to North Korean actors: the Bybit hack, reported by Cointelegraph as a $1.5 billion incident. Cointelegraph coverage also noted that funds from that attack were reportedly swapped on THORChain. THORChain has often been described as a decentralized liquidity mechanism rather than a privacy mixer, and the general claim in the surrounding debate is that funds are still traceable after being swapped. That traceability is crucial: it gives victims and investigators a basis for arguing that specific on-chain participants should be restricted, even if the destination is a decentralized protocol. However, what victims want—address-level blocking—may not align with how THORChain is technically or politically structured. The article notes that THORChain previously paused its chain quickly following its own $10.7 million hack in May. That detail highlights that the protocol can react decisively to security events, even as it faces scrutiny over whether it can selectively censor or restrict particular counterparties. Can THORChain blacklist, and should it? Whether THORChain can blacklist addresses is described as unclear in the reporting. The text points to a reference from February 2025, when THORChain said it had retired an admin key that would have provided the power to blacklist certain addresses. This uncertainty is important for readers because it changes the nature of the request from “should a protocol do this?” to “can the protocol do this at all without undermining its own design?” Even if governance messaging supports compliance, protocol capabilities and key management can set hard boundaries on what is feasible. Meanwhile, critics of address blocking argue that allowing decentralized protocols to respond to coercive demands would create a censorship precedent. The debate also includes an “ethics versus practicality” tension: victims emphasize harm reduction and reducing stolen-fund liquidity, while decentralization advocates emphasize permissionless access as an anti-tyranny safeguard. At the same time, the article draws attention to concerns about THORChain’s decentralization level compared with Bitcoin or Ethereum. It cites the idea that THORChain does not match the governance model of the most decentralized networks and references past claims around administrative functionality. Those points are used to argue that the protocol’s permissionless claims may be overstated in practice. For traders and builders, the operational reality is what matters most: if a protocol cannot enforce address-level exclusions, then users may still be exposed to flows they would rather avoid. If it can enforce them, then the network may face governance attacks, reputation risk, and the possibility of politically motivated address targeting. Either way, the outcome affects how participants assess risk and compliance expectations. Market reaction and what to watch next The controversy has not only sparked governance debate; it also appears to have attracted market attention. The article states that THORChain’s native token RUNE surged 50% over a week amid the publicity around the dispute. Looking ahead, the key question is whether THORChain will clarify what address-level controls it can implement—if any—and what governance process would apply if requests from centralized exchanges are escalated. Readers should also watch how the underlying theft narrative evolves: Bitget’s attribution remains tied to preliminary investigation signals, and the strength of the evidence will influence whether future calls for restrictions gain wider traction. In parallel, this episode underscores a broader industry challenge: even in decentralized systems, “who can stop stolen funds?” will increasingly depend on technical capabilities, governance choices, and the willingness of markets to treat permissionless routing as either a resilience feature or a liability. This article was originally published as THORChain Faces Scrutiny Over Bitget as Ethereum’s Role Expands on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.

THORChain says “We’re decentralized. We’re permissionless” THORChain’s main purpose is simple: •Native $BTC → $ETH •Native ETH → BTC Cross-chain swaps without wrapped assets or a centralized exchange. Every swap generates fees. In Q2 2026, THORChain reported $2.37M in swap fees from $2.06B in volume. But here’s the interesting part… THORChain has been the victim too. In 2021, THORChain suffered major exploits. In one incident, attackers drained around $8M through the ETH router. THORChain halted the network, fixed the issue, and said its treasury would cover affected LP losses. Then in May 2026, THORChain was attacked again. Around $10.7M was drained from an Asgard vault through a cryptographic vulnerability. Its security system detected the abnormal activity and halted signing and trading while developers and node operators worked on the fix. The network eventually restarted after a five-week halt. So here’s where the debate gets interesting "When THORChain is attacked, it can stop the network to protect itself and its users" But when stolen funds are flowing through the protocol… should it stop them too? THORChain earns fees from the flow. So the simple question is "If you earn from the flow, should you also care about the flow?" Decentralization removes the central gatekeeper. But does it remove responsibility too? That’s the real THORChain debate now 👀