What actually happened?
On September 24, 2026, the Bitget exchange became the target of an attack that, according to available sources, drained funds worth roughly $387.5 million. Since then, attention has shifted not only to the attackers but also to the protocols and decentralized services through which the stolen money is moving.
That raises an uncomfortable question: if a decentralized protocol like THORChain (a cross-chain liquidity network that enables swaps between different blockchains without a central intermediary) does not block addresses tied to the hack, can its developers be held criminally liable?
Can THORChain even block the addresses?
According to Cointelegraph's reporting, THORChain will not, or cannot, block the addresses tied to the Bitget hack. That is a fundamental difference from centralized exchanges, which can freeze an account by decision of their compliance department.
Cointelegraph quotes crypto lawyer Yuriy Brisov, who says the question of potentially prosecuting developers for money laundering is "complicated." In other words, there is no simple yes/no answer. The legal responsibility of decentralized software creators for how third parties use it remains an unresolved area in many jurisdictions.
It is important to separate fact from speculation. The fact that the question of liability has been raised is a fact. Whether prosecution would actually happen is, for now, unknown.
Where is the stolen money going?
The money trail points to two distinct strategies by the attackers.
Zcash and the Ironwood private pool
According to CoinDesk, the attackers moved roughly $4 million in Zcash (ZEC) into a private pool called Ironwood. Three transfers there sent about 15% of the stolen ZEC, according to CoinDesk. Ironwood is an environment where payments hide the sender, recipient, and amounts, which makes tracing funds significantly harder.
NEAR Intents and the SHIELD system
By contrast, NEAR Intents says its risk system SHIELD caught transfer attempts tied to the hack totaling over $50 million and blocked most of them. According to general manager Alex Shevchenko (quoted by The Defiant):
| Amount | Status |
|---|---|
| over $50M | detected transfer attempts |
| ~$503,000 | frozen during execution |
| ~$166,000 | still got through |
The difference between THORChain's approach and that of NEAR Intents is a clear illustration of how differently individual protocols can respond to the same incident.
Why does it matter?
This case pushes to the forefront a question that will recur with every major hack: where does protocol neutrality end and the responsibility of its creators begin?
Centralized exchanges and services have both the tools and the legal obligation to freeze suspicious funds. Decentralized protocols either lack such tools or refuse to use them on principle. Regulators and courts do not yet have a unified interpretation of how to approach this.
What is the broader market backdrop?
For context: according to Decrypt, bitcoin ETFs recorded inflows of nearly $2.95 billion over the past 30 days, marking the eighth straight day of inflows after the sell-off tied to the so-called Clarity Act. This news is not directly related to the Bitget hack, but it shows that institutional appetite for bitcoin remained strong during that period, independent of the theft reports.
What to watch in cases of this kind
- Legal developments: whether specific charges or subpoenas emerge aimed at protocol developers, not just the attackers.
- Fund tracing: how much of the stolen $387.5 million can be recovered after part of it disappeared into private pools like Ironwood.
- Protocol responses: whether more decentralized services introduce systems similar to SHIELD, or remain strictly neutral.
Charliedesk does not evaluate this case as a recommendation to buy or sell anything. We describe what happened and what remains uncertain.