Star Xu, founder of OKX, has cast doubt on THORChain’s assertion that it functions as a completely decentralized blockchain. This disagreement arose after reports surfaced that funds connected to the Bitget hack traveled through the cross-chain network. While Bitget is seeking assistance to block the perpetrator, THORChain maintains that its permissionless architecture prevents it from blocking specific users.
This controversy unfolds as Bitget tracks the funds taken from its wallets and gets ready to reopen withdrawals. Its verified total now sits at roughly USD 387.5 million.
Bitget Raises its Estimate to USD 387.5 Million
At 18:31 UTC on September 24, Bitget detected unauthorized withdrawals from several hot wallets, prompting it to halt withdrawals and initially estimate the loss at USD 351.6 million. The exchange noted that its cold wallets were unaffected and that its protection fund exceeded USD 464 million.
Additional tracking pushed the total sent to addresses controlled by the attacker up to USD 387.5 million. Bitget explained that this update accounted for Zcash and Tron transfers that were left out of the initial tally, rather than new transfers occurring after the incident was locked down. The exchange added that Mandiant and SlowMist are helping with the probe.
Bitget has mapped out a timeline to restart Bitcoin withdrawals on September 28, Ethereum on September 29, and USDT on September 30. Remaining tokens, fiat withdrawals, and peer-to-peer functions are scheduled to come back online on October 2. These dates represent a planned timeline rather than confirmation that services have actually restarted.
Xu Questions Who Controls THORChain Vaults
Gracy Chen, CEO of Bitget, asked THORChain to block transactions originating from addresses associated with the hacker. This appeal highlighted the network’s function in facilitating cross-chain asset transfers and brought up operational questions regarding whether network operators have the ability to intervene with publicly identified wallets.
In a public statement, Xu pushed back against THORChain’s comparisons to Bitcoin and Ethereum. He contended that its validators share collective control over assets stored in vaults via a threshold-signing mechanism.
I don’t think THORChain’s TSS + validator model represents true decentralization.
The selected validators set collectively controls the underlying assets in the TSS vaults. Once the signing threshold is reached, those validators can move the funds. So from a custody perspective,… https://t.co/nEajr1ZLzz
— Star_OKX (@star_okx) September 26, 2026
Through this setup, a designated quorum of validators must approve transfers. Xu argued this dynamic positions THORChain as an intermediary, even if no single validator holds sole authority over a vault.
In response, THORChain’s official channel pushed back against that perspective. The network defined itself as decentralized and permissionless, while questioning if base-layer blockchains ought to face similar expectations when illicit funds route through them. Consequently, the two parties disagree on both the true nature of the network’s decentralization and the accountability that entails.
Stablecoin Freezes Show Another Recovery Route
Circle and Tether blocked roughly USD 318,000 worth of USDC and USDT tied to a wallet connected to the Bitget breach. At the time of the block, the address held approximately 99,990 USDC and 218,023 USDT. While issuer tools can halt those specific tokens, they do not grant Circle or Tether authority over ETH stored in that same location.
Additionally, Bitget has introduced a bounty initiative for asset recovery. The program provides participating entities with 5% of the affected assets they successfully help freeze or retrieve. To aid tracking efforts, the exchange has released the hacker’s addresses alongside a real-time tracing dashboard for interested firms.
The confirmed freezes represent only a minor fraction of Bitget’s USD 387.5 million loss estimate. Further recovery efforts rely on the destination of the funds and whether the intermediary services can restrict those transactions. Bitget’s update on September 28 is expected to cover both the ongoing investigation and the reinstatement of withdrawals.
ALSO READ: Bitget Suspects North Korean Hackers in USD 351.6M Security Breach
