THORChain responds to Bitget, stating that the network pause is only to protect protocol security.

THORChain said a network halt is used to protect overall protocol security, not to freeze selected addresses or individual transactions, after Bitget reported a September 24 security incident involving about $387.5 million and said some stolen funds moved across chains through THORChain. Bitget CEO Gracy Chen had asked the network to deny service to confirmed attacker addresses. The response shows how a permissionless protocol can limit direct intervention even when centralized platforms request enforcement after a breach.

A halt tool is not an address block

The core of THORChain’s response is the distinction between pausing network activity and targeting participants. A network halt can be used when the protocol itself needs protection, but THORChain said that tool is not meant to single out specific addresses or transactions. That position places the incident in a wider gray zone: Bitget wanted action against confirmed attacker addresses, while THORChain framed its available mechanism as a security measure for the network, not a selective censorship or recovery tool.

For readers, the practical point is that an on-chain transfer path can become part of a post-hack dispute without giving the transfer network the same recovery powers that a centralized exchange may have over its own platform.

The May incident set the precedent

THORChain also pointed to its own May security incident, which involved about $10.7 million. In that case, the attacker addresses were not blacklisted. The reference strengthens the company’s argument: THORChain did not treat address-level denial as a normal response after being attacked itself, and it signaled that it would not change that stance for Bitget’s request.

This matters because the protocol’s permissionless design is not just a marketing phrase in this story. It defines what THORChain is willing to do when funds move through its network. The protocol may be able to pause activity to protect its security, but the source shows it is not positioned to enforce exchange-level sanctions against particular addresses.

What remains unresolved

Bitget’s request leaves a difficult question open: how much responsibility can a cross-chain network take when stolen funds pass through it? The incident involves a September 24 attack, about $387.5 million, confirmed attacker addresses, and a public appeal from Bitget CEO Gracy Chen. THORChain’s answer is that its network halt is a protocol security tool, not a mechanism for selective address freezing, and that its May experience with about $10.7 million reinforces that boundary.

The follow-on issue is whether centralized platforms will seek more direct cooperation from on-chain networks after hacks, or whether such networks will remain limited to protocol-wide safety measures.