Bitget Got Hacked. Why Is THORChain on Trial?
Bitget restored its protection fund to more than $300 million after the Sept. 24 security incident and said remaining cryptocurrency withdrawals were set to resume. Onchain tracing and blockchain-analytics coverage linked the stolen XRP and related movements to THORChain and to North Korea-linked activity, while the debate around THORChain centered on whether permissionless systems can or should block stolen funds.
What this rests on
What it means
Each sentence links inside to the piece that supports it.
Bitget customers and traders are the first group to notice this change, because the exchange said withdrawals for remaining cryptocurrencies were set to restart while customer claims were still under review. Regulators and security teams in the sector also see a larger case for attention, since the stolen XRP was linked to North Korea and the theft moved through THORChain and CoinJoin.
In practice, the case changes what can be expected from THORChain and similar systems: one lawyer said THORChain would not, or could not, block the linked addresses, so the network kept operating as a permissionless system. What also stayed in place was the onchain routing of the stolen funds, which BlockSec traced across Bitcoin, THORChain and CoinJoin.
Market reaction
How the story was built
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 3.9 years ago | FTX · Phishing incident | $450M |
| 5.8 years ago | OneCoin · Scam incident | $440M |
| 23 days ago | Bitget incident | $351.6M |
| 4.7 years ago | Portal · Signature Verification Flaw incident | $326M |
| 41 days ago | Liquid Network incident | $320M |
4197 incidents stored · 20 were as large as this one or larger ($387M)
What could happen next
What the prediction markets currently price as likely. This is context, not a forecast of ours: there is money on it, and that is all we show.