The movement of hundreds of millions of dollars stolen from Bitget has exposed a fundamental divide in crypto: should cross-chain protocols remain neutral even when linked to hacked funds, or should they intervene when technology can identify and stop suspicious transactions?
According to Cointelegraph, the dispute began after Bitget was hacked on Sept. 24. About $387.5 million in stolen assets started moving between blockchains, with some of the funds directed toward THORChain, a decentralized platform that enables cross-chain swaps. Bitget chief executive Gracy Chen publicly asked THORChain to reject addresses connected with the attack.
THORChain declined to do so. The decision has intensified an existing argument about the meaning of “permissionless” infrastructure, a core crypto principle under which users can transact without approval from a central authority. THORChain’s position is that refusing individual transactions would conflict with the protocol’s design.
Boone Wheeler, a THORChain developer, said a genuinely permissionless protocol cannot act on the origin of funds because it is not designed to distinguish between particular users or transactions. He argued that adding the ability to block identified stolen assets would mean the protocol was no longer permissionless.
The controversy is not new for THORChain. The protocol previously allowed hackers connected to the Bybit attack to move $1.2 billion through its infrastructure. That earlier episode has made the platform’s position on neutrality especially visible in the latest dispute.
A contrasting response from NEAR Intents
NEAR Intents, a competing cross-chain transaction service, took a different approach. Its automated security system, called SHIELD, identified more than $50 million in attempted flows associated with the Bitget incident. The system stopped $503,000 during execution, while $166,000 passed through, according to the material reported by Cointelegraph.
NEAR also waived its share of Bitget’s recovery bounty. Alex Shevchenko, general manager of NEAR Intents, said the wider NEAR Protocol remains open: users can transact, deploy contracts and become validators without permission. However, he distinguished the underlying network from applications built on it, arguing that an application does not have to process every request.
SHIELD’s intervention has itself drawn criticism. Opponents say that blocking transactions shows NEAR Intents is not fully permissionless or decentralized, and could create expectations that the service should apply similar controls more broadly. Crypto lawyer Yuriy Brisov takes a different view because SHIELD operates automatically rather than through a human compliance team. In his assessment, automated screening may still fit within protections associated with decentralized protocols.
Where intervention becomes possible
Bitget’s Chen said different protocols have different architectures, governance systems and technical capabilities. In her view, that does not resolve the distinction between open infrastructure and actively facilitating the movement of funds known to be stolen.
She welcomed NEAR Intents’ response and said Bitget would pursue the appropriate legal and recovery process. Chen also called for the industry to examine what is technically and governance-wise possible when stolen assets are identified. Potential measures could include tracing and sharing information, declining transactions, freezing assets where infrastructure permits, and assisting recovery through legal or law-enforcement channels.
THORChain’s refusal is complicated by the fact that the network has emergency intervention tools. Following an exploit in May, the protocol’s post-mortem said automatic solvency checks halted activity after an attacker drained more than $10 million from one of its vaults. Node operators can also use broader emergency controls to pause trading, signing and other network functions.
Wheeler said those halts are reserved for active protocol problems and are supported by consensus among THORChain’s nodes. He also said the system has no feature for screening individual addresses or transactions, describing that limitation as an intentional design choice.
The cost of choosing neutrality
The debate is also about the risks of giving protocols the power to censor transactions. Joël Valenzuela, a libertarian and cypherpunk associated with Dash, said a permissionless protocol should not draw a line when stolen funds are identified. In his view, any ability to intervene would make the system permissioned and could eventually enable censorship of innocent users.
Valenzuela argued that centralized exchanges holding large amounts of customer assets should improve their security, while decentralized exchanges represent the longer-term direction of the sector.
Max Shannon, a senior research associate at Bitwise Europe, said newer protocols such as THORChain and NEAR still need to establish trust. He described refusing to process hack proceeds as a sound position, but suggested THORChain’s neutrality could cause more money-laundering activity to move away from NEAR Intents and toward THORChain.
The disagreement therefore extends beyond the Bitget recovery effort. It is a test of whether crypto users value “credible neutrality” above all else, or whether open networks can use automated safeguards without abandoning decentralization.
Moneyiar market picture
Moneyiar data at 09:13-09:14 on Oct. 3, 2026, showed Ethereum at $2685.7774775912, down 2.37% over 24 hours and up 0.2% over seven days. NEAR Protocol traded at $4.6718725282, down 5% in 24 hours and 4.31% over seven days.
THORChain’s RUNE was priced at $0.737645599, down 6.33% over 24 hours but up 5.36% over seven days. Basic Attention Token stood at $0.0958250735, up 2.71% over 24 hours and 2.27% over seven days.
