The aftermath of the $387.5 million Bitget hack has placed THORChain at the center of a debate over decentralization, censorship and potential legal exposure in decentralized finance (DeFi).
Suspected North Korean hackers exploited the crypto exchange last week, after which investigators quickly identified and tracked the addresses that received the stolen assets. Bitget CEO Gracy Chen publicly called on THORChain, a decentralized cross-chain swapping protocol, to stop serving those addresses.
THORChain rejected the request, arguing that it operates without permissioned control in the same way that major blockchain networks such as Bitcoin, Ethereum and BNB Chain do. The protocol has also said it lacks a straightforward mechanism for censoring individual addresses. Its administrative key was retired in February 2025, removing the core team’s ability to make unilateral changes, while the network has about 100 validators.
According to Cointelegraph, crypto lawyer Yuriy Brisov of D&A Partners said the legal consequences depend heavily on how much practical control a protocol has over transactions and assets.
Decentralization can be both protection and liability
Brisov said a protocol’s claim to be decentralized can provide an important legal defense. If a system genuinely cannot intervene in user activity, its operators may argue that they should not be responsible for what participants do through it.
However, taking action against specific addresses may weaken that argument. If a project demonstrates that it can block, control or otherwise interfere with transactions, claimants could argue that it should also use that power in other circumstances. Those claims could involve alleged fraud, market manipulation, volatility-related losses or the conduct of token issuers.
The question is therefore not simply whether blocking stolen funds is viewed as a responsible step. It is also whether that intervention suggests the platform has broader oversight responsibilities, including possible know-your-customer and anti-money-laundering controls similar to those used by centralized exchanges.
Brisov pointed to the legal tension already seen in the sector. Investors sued Uniswap after purchasing 38 tokens alleged to be rug pulls and scams, but a judge dismissed the case in March. The lawyer described full decentralization as the strongest defense available to a DeFi protocol, while warning that any demonstrated control could make that defense less effective.
THORChain and NEAR took different approaches
The disagreement follows an earlier incident involving THORChain. The protocol was used to swap approximately $1.2 billion of the funds stolen in the $1.46 billion Bybit hack. Its administrative key had been retired only 11 days before that incident, according to the source material. Brisov said legal action against THORChain could still arise in the future and that the Bybit case created potential claims against the protocol.
THORChain was also halted immediately after an exploit involving $10.7 million of its own funds in May. The protocol has said that the halt was triggered initially by an automated system, rather than by a person manually selecting addresses for censorship. Brisov said that explanation might help its legal position, although the issue has not yet been tested in court.
NEAR Intents adopted a different model after the Bitget incident. Its automated SHIELD system blocked addresses associated with the hack from swapping about $50 million through the platform. NEAR also declined Bitget’s offer of a 5% bounty for taking that action.
The automated design may be significant legally. Brisov said a system that automatically detects addresses linked to known hacks and blocks them, without a compliance team manually deciding each case, is more likely to be viewed as a good-faith protective measure while preserving a stronger decentralization argument. He described automated safeguards as a solution that DeFi companies should consider.
At the same time, NEAR’s decision has attracted criticism from advocates of strict permissionlessness, who argue that blocking users means the platform is not sufficiently decentralized. The dispute highlights the trade-off facing DeFi developers: intervention may protect users and the wider ecosystem, but it can also raise questions about who is responsible for decisions made by the protocol.
Why the money-laundering question is unsettled
Bitget’s stolen assets could be swapped through THORChain while remaining transparently connected on the blockchain to the addresses associated with the hackers. That raises a separate question: whether processing such a swap could expose the protocol’s developers to allegations of money laundering or receiving stolen property.
Brisov said he did not see a clear basis for holding THORChain liable for money laundering. He explained that US law generally treats money laundering as the movement of illicit proceeds through channels in an attempt to make them appear legitimate. In his view, immutable smart contracts are not property that developers own or control, making the legal analysis different from that applied to conventional financial institutions.
He referred to the Tornado Cash litigation, saying the argument that its smart contracts were not controlled or owned by the developers helped the project in proceedings involving sanctions by the US Treasury’s Office of Foreign Assets Control. The lawyer nevertheless stressed that THORChain’s position has not been conclusively resolved by a court.
The case illustrates why the legal status of DeFi remains difficult to define. A protocol may be designed to operate automatically and without a central administrator, yet its developers, validators or surrounding organizations may still face scrutiny if they can upgrade software, halt operations or restrict access.
Current market picture
Moneyiar market data at 09:19 on October 1, 2026, showed THORChain’s RUNE at $0.786270703, up 3.79% over 24 hours and 28.24% over seven days. Chainlink’s LINK was $14.2760629902, down 0.48% over 24 hours but up 16.8% over seven days.
At 09:18, Moneyiar data showed Monad at $0.0324220415, up 19.2% in 24 hours and 35.67% in seven days. Compound’s COMP was $24.4313575314, down 4.44% over 24 hours and up 5.07% over seven days.
