Skip to content
Blockchain LabTHE VENTURE STUDIO

BLOCKCHAIN LAB BRIEFING · SECURITY

THORChain Answers a Stolen-Funds Question by Pointing at Bitcoin

The argument is the policy. A permissionless swap venue will be used by thieves if it works. Saying Bitcoin has the same property does not decide what the interface should do.

26 September 2026

All briefings

01

What happened

On 26 September 2026 @THORChain replied to a @MistTrack_io post. The tracker had written that after the Bybit theft of the prior year, nearly $1.2 billion of proceeds were reported as moving through THORChain, and that funds from a later Bitget incident were again being sent in for swaps. The tracker asked what responsibility a protocol has when it knows funds come from a publicly identified hack. THORChain's answer says it is devastated about the recent exploit, that THORChain is decentralised and permissionless like Bitcoin, Ethereum and BNB Chain, and asks what responsibility those chains should bear. The snapshot of THORChain's post shows 159 reposts, 192 quotes, 373 replies and 1,286 likes.

The $1.2 billion figure and the Bybit history are in the tracker's post, not independently re-traced here.

02

Why it matters

There is a real distinction the reply leans on. A base chain that cannot freeze a transfer is not the same object as a front end, a resolver, or an affiliate that can refuse a quote. The reply does not say which of those THORChain is in this incident.

Analogising to Bitcoin settles the argument only if you already believe every layer above a chain inherits the chain's neutrality. Many interfaces do not behave that way, and the tracker is asking about the interface that keeps routing known funds.

03

The operating layer

A firm that uses a cross-chain swap as a payout rail has to decide what it does with a listed address. 'We are like Bitcoin' is not a sanctions procedure and not an answer a bank will accept.

This page does not publish addresses and does not describe how to move anything.

04

What is verified

THORChain's post is the project's reply. MistTrack's post is the accusation it was answering, including the Bybit figure as MistTrack stated it.

This desk has not matched transactions.

05

What is still unclear

Whether any THORChain interface currently blocks the addresses the tracker named.

How much of the cited flow was the protocol and how much was a downstream interface.

What 'known' means in time: flagged where, and how fast.

06

The catch

A permissionless protocol will process whatever its rules allow. That sentence can be true and still be incomplete. The incomplete part is what the people who run the websites and the affiliates do once a public label exists.

WATCH

What builders should watch

  1. 01Whether the project publishes a policy beyond the analogy.
  2. 02The tracker's later notes, treated as the tracker's.
  3. 03The difference between the protocol and a hosted front end.
  4. 04That this page is not a tracing report.

BOTTOM LINE

THORChain's answer to a stolen-funds critique is that it is permissionless, like Bitcoin. That is a design claim. It does not say whether any interface in front of the protocol will refuse a swap the industry has already labelled.

Sources

Blockchain Lab uses public social posts as reporting leads, not as proof. Every published briefing is assessed against primary sources, available documentation and relevant technical context. Social engagement is not used as evidence of the underlying claim.

Continue