THORChain has refused Bitget's call to reject transactions from addresses tied to the $387.5 million hack, saying it is decentralized and permissionless like Bitcoin, Ethereum and BNB Chain and asking what responsibility those networks should bear when handling known stolen funds. The request from Bitget CEO Gracy Chen followed a warning from MistTrack, the on-chain tracking platform run by security firm SlowMist, that proceeds from the Sept. 24 breach are flowing into THORChain for asset swaps and cross-chain bridging.

MistTrack said the routing repeats the pattern after the Bybit hack, when nearly $1.2 billion in stolen funds was routed through THORChain for cross-chain transfers. Chen said the attacker addresses have been made public and remain under active surveillance, and on-chain analysis firm Arkham has labeled 26 of them. "Decentralization is a design principle, not a shield for facilitating known stolen funds," she said. OKX said it took action immediately and stood ready to support efforts to identify, track and block the movement of hacked funds.

The Sept. 24 breach, in which attackers compromised a backend system to spoof transaction data and drain hot and warm wallets, is very likely linked to North Korean hackers, Chen said, citing IP addresses that match VPN patterns used by a group associated with the DPRK. On-chain researchers have traced bridged XRP from Bitget to funds stolen in the $24 million AFX hack in July, which was attributed to the TraderTraitor group. Bitget resumed withdrawals two days after the breach, says the loss is covered by its User Protection Fund of more than $464 million, and has launched a recovery bounty offering 5% of successfully frozen or recovered funds.