Crypto’s long-running argument over whether decentralized protocols should block stolen funds flared again after the Bitget hack. According to the reporting around the incident, roughly $387.5 million in funds tied to the attack began moving across chains, and some of that activity reportedly headed toward the decentralized cross-chain swap platform THORChain.
Bitget CEO Gracy Chen publicly urged THORChain to refuse service to attacker-linked addresses, warning that “the industry is watching.” THORChain did not comply, and the decision has now become the focus of a broader debate: should permissionless infrastructure be technically capable of stopping known illicit flows—or does any ability to filter such activity undermine decentralization?
Key takeaways
- Bitget’s CEO called on THORChain to block services for addresses linked to the Sept. 24 hack, as an estimated $387.5 million in stolen funds moved across chains.
- THORChain declined, reigniting a dispute between those who want protocols to refuse stolen funds and those who argue that permissionless systems must remain blind to provenance.
- Critics point to a past May response by THORChain—when validators halted trading after an automated system triggered during a vault-draining exploit exceeding $10 million.
- NEAR Intents, a cross-chain transaction competitor, has taken a contrasting approach through an automated security layer (SHIELD) that identifies and blocks some hack-linked flows.
- NEAR’s team argues permissionlessness can coexist with automated, targeted controls, while THORChain’s developers frame “known stolen funds” screening as incompatible with true permissionless design.
THORChain’s stance: permissionlessness and provenance screening
The core of the argument centers on what “permissionless” should mean in practice. THORChain developer Boone Wheeler argues that a genuinely permissionless protocol cannot selectively treat funds based on their provenance. As he explained in response to the criticism, a permissionless system is “blind to their provenance,” and enabling it to block specific stolen funds would effectively make it permissioned.
The backdrop to this position is not hypothetical. The report notes THORChain had previously been used during major exchange-related hacks, including an episode described as Bybit hackers moving $1.2 billion through the protocol. For proponents of THORChain’s approach, that track record is less an indictment of the design than a reminder that permissionless infrastructure cannot—and should not—be expected to behave like centralized compliance tooling.
Where the critics see the contradiction
Critics argue THORChain’s “hard line” on censorship-by-design doesn’t fully match its operational history. The debate cites Cointelegraph reporting about THORChain halting trading in May after an automated system triggered during a vulnerability that drained more than $10 million from a vault.
NEAR Intents is often raised as a direct counterexample. According to the coverage referenced in the article, NEAR’s SHIELD layer identified more than $50 million in attempted flows tied to the Bitget incident and stopped $503,000 during execution, while additional amounts were able to pass through (the report says $166,000). Supporters of NEAR’s model argue that automated detection and targeted intervention are a practical middle ground rather than a betrayal of decentralization.
NEAR Intents: permissionless access, automated targeted controls
NEAR Intents general manager Alex Shevchenko frames the issue as separation of open participation from the obligation of every application to process every request. In the discussion, he emphasizes that NEAR Protocol itself is permissionless—anyone can build, transact, and become a validator—but that does not automatically mean every application must accept all flows.
NEAR Intents’ SHIELD reportedly uses a combination of public on-chain signals, an internal anti-money laundering (AML) database, and third-party intelligence providers referenced in its risk and compliance documentation. In addition to the Bitget-related activity, the article notes that SHIELD previously identified suspicious behavior connected to an Omni deposit/withdrawal interaction exploit worth $3.8 million and halted activity.
Shevchenko’s argument is that blocking suspected stolen funds protects not only NEAR Intents but also the wider cross-chain ecosystem. He ties the policy choice to a broader outcome: hacks drain capital and activity, so screening and restricting money laundering helps preserve the integrity of the on-chain economy.
“Permissionless” versus “neutral”: the libertarian critique and the investor trust question
The opposing view in the article is articulated by Joël Valenzuela, a libertarian and cypherpunk associated with Dash. He argues that permissionless protocols should not draw a line at all, even when stolen funds are identified, because the ability to filter introduces permissioning by another name. For him, preventing stolen funds is an opening to broader censorship pressures—what he calls Pandora’s Box—where eventually “censorship of innocents” becomes possible.
Valenzuela instead points to centralized exchanges as places where security and operational hardening should be strengthened, asserting that exchanges that custody large sums should take security more seriously and arguing that decentralized exchanges are “the way forward.”
From the perspective of research and market structure, Max Shannon of Bitwise Europe is quoted emphasizing trust-building. He suggests that newer protocols still have to earn credibility, and he calls the refusal to launder hack proceeds a sound stance. He also expects that if THORChain refuses to block stolen funds, some money laundering flows may shift toward the alternative protocol model represented by NEAR Intents—essentially transforming the competition into one over “who will intervene” once illicit activity appears.
Shannon characterizes the dispute as a clash between a “credible neutrality at all costs” ideal and the practical reality that protocols may increasingly be evaluated by how they respond to known abuse. He argues that this is where the NEAR Intents approach differs from THORChain, framing the difference as not only technical but philosophical—what the system optimizes for, and at what cost.
What to watch next
As this argument moves from theory to repeated incidents, investors and builders should watch whether automated, targeted controls become more standardized across cross-chain platforms—and whether THORChain’s “no provenance screening” design remains sustainable as users, counterparties, and regulators apply pressure. The next major hack-linked routing will likely determine which model gains wider legitimacy in the real world.
Be the first to comment