GoPlus Security rejected THORChain's defense for refusing to block the $387.5 million stolen from Bitget, arguing the cross-chain protocol cannot compare itself to Bitcoin or Ethereum because its outbound transfers rely on threshold signatures from a relatively small active validator set. GoPlus said THORChain already includes pause, per-chain signing halt and governance mechanisms, pointed to prior intervention during THORChain's own exploit, and argued that FBI- or OFAC-attributed North Korea-linked funds could be blocked under the protocol's existing emergency framework.

The rebuttal follows THORChain's refusal of Bitget CEO Gracy Chen's formal request to reject transactions from the publicly flagged attacker addresses. THORChain said it was saddened by the exploit but stressed that it is decentralized and permissionless like Bitcoin, Ethereum and BNB Chain, asking what responsibility those networks should bear when handling known stolen funds. MistTrack, the tracking platform run by SlowMist, had warned that Bitget hack proceeds are flowing into THORChain for swaps and cross-chain bridging, repeating the pattern after the Bybit hack, when nearly $1.2 billion in stolen funds was routed through the protocol. OKX said it took action immediately and stood ready to support efforts to identify, track and block the movement of hacked funds.

GoPlus's technical review of the breach found the attackers exploited the transaction-signing trust chain rather than leaking private keys, breaching a wallet backend system and forging transaction data so Bitget's authorized signing flow generated valid signatures for unintended transfers. The drain window lasted about 2 hours and 25 minutes, with the largest wave moving roughly $185 million in about one minute, and GoPlus noted structural similarities to the 2025 Bybit hack. Separately, AMLBot traced about 4 BTC from the theft into a Wasabi CoinJoin round, following a path that converted funds from TRX to USDT, bridged them to Ethereum, swapped them into about 145 ETH and routed them through THORChain into roughly 4.59 BTC before they were split and sent into CoinJoin. AMLBot has blacklisted the related addresses.