THORChain Refused to Block the $387M Bitget Hacker. Here’s Why | Chad Barraford

Chad Barraford said THORChain had no formal process for Bitget to request intervention after the $387.5 million hack; the appeal came in a tweet, and he had no direct contact with Bitget. He argued that validators are responsible for securing THORChain, not policing outside entities, and that the theft alone did not justify stopping all trading. The network has no individual with authority to block a swap, and Barraford said there was little community appetite for censoring a particular wallet or transaction.

Barraford distinguished a network-wide halt from selective blocking. Three nodes can vote to halt trading, he said, while four, five, or six can vote to reverse the halt. Reaching consensus to block a specific transaction or wallet takes about three days on average and could take as long as two weeks—ample time for funds to be swapped and moved. Validators collectively hold users’ assets during swaps, monitor activity across chains, and execute trades with native assets rather than wrapped tokens; a Bitcoin-to-Ether swap routes through Rune, with both legs occurring in one block.

He said validators would quickly halt trading to contain a protocol-level security problem, but would be unlikely to halt because an external hacker was moving funds. In May, THORChain stopped trading while developers investigated and patched a vulnerability that drained about $10.7 million from one of its six vaults; the interviewer said the network remained halted for 39 days. Barraford said a flaw in the GG20 threshold-signing implementation could expose key shares after repeated interactions, allowing an attacker to obtain a private key. The team knew a key had leaked but lacked logs to determine exactly how, temporarily closed the GG20 library, and planned to open-source it again. FROST and DKLS were among the alternatives under consideration.

Barraford said an indefinite halt over an external exploit would leave validators unable to determine when it was safe to resume. He contrasted THORChain’s public validator communications with Bitcoin’s capacity, in his view, for developers to privately alert major miners and coordinate a software change. He also argued that Bitcoin miners could reject transactions if 51% agreed, though the interviewer characterized that as a high bar. Barraford said he lacks validators’ identities and private channels for coordinating with them, and that private coordination could expose node operators or lead to them being banned.

The Bitget decision followed an earlier dispute over the Bybit hack, which Barraford estimated at about $1.4 billion. He said roughly 10–20% of validators were uneasy about THORChain’s non-censorship stance, but a proposal to stop trading in affected pools lost by a large margin. About 20 validators left after that dispute, he said, though the network later had more validators than before. The episode illustrates the trade-off he described: stopping activity might impede an external attacker, but could also impose a broad halt without a clear, workable trigger for restarting.

Barraford rejected the idea that swap fees meaningfully motivate THORChain to process illicit funds, comparing them with Bitcoin miner fees. He estimated that possibly stolen funds account for about 1% of roughly $125 billion to $127 billion in THORChain trading volume over the past few years, and said illicit activity is an extremely small share of its activity. In his view, Bitcoin is an efficient exit route for hackers because it is large and liquid, while THORChain can facilitate swaps into Bitcoin or Ethereum before funds move to centralized exchanges. He argued that authorities should focus on centralized actors that obscure information or facilitate crime.

He also described Tether’s temporary blacklisting of THORChain vault addresses, which affected about $1.4 million in Tron USDT and was reversed a few hours later. The reason was never established; Barraford suspected Tether may have mistaken vaults for ordinary addresses during a hack investigation. He said THORChain would not change its policies over what he believed was an accidental blacklist, but would delist USDT if it were permanently blocked. Across these examples, he framed the network’s limited ability to intervene not as a judgment that every transaction is legitimate, but as a consequence of its decentralized design and the distinction between responding to a protocol failure and policing activity elsewhere.