Tag: stablecoin freeze

  • OKX Founder Challenges THORChain’s Decentralization Claims After Bitget’s $387.5M Breach

    OKX Founder Challenges THORChain’s Decentralization Claims After Bitget’s $387.5M Breach

    OKX founder Star Xu has publicly questioned THORChain’s claim to true decentralization after funds linked to the Bitget security breach reportedly moved through the cross-chain network. The exchange now estimates the attacker made off with approximately $387.5 million and is asking industry partners to help block the stolen assets.

    Bitget Raises Loss Estimate to $387.5 Million

    On September 24, Bitget detected unauthorized transfers from certain hot wallets at 18:31 UTC. The exchange initially placed the damage at $351.6 million and paused withdrawals, while noting that cold wallets remained secure and its protection fund held more than $464 million.

    After further tracing, Bitget revised the amount sent to attacker-controlled addresses to $387.5 million. The update included Zcash and Tron transfers that were omitted from the initial figure; it did not reflect new transfers after the breach was contained. Mandiant and SlowMist are assisting with the investigation.

    Withdrawal restoration is scheduled in stages: Bitcoin on September 28, Ethereum on September 29, USDT on September 30, and other tokens, fiat withdrawals, and peer-to-peer services on October 2. Bitget stressed these dates are a restoration schedule, not confirmation that withdrawals have resumed.

    Star Xu Questions THORChain’s Validator Model

    Bitget CEO Gracy Chen asked THORChain to refuse transactions from addresses linked to the attacker. That request highlighted the network’s role in moving assets between blockchains and raised questions about whether its operators can act on publicly flagged wallets.

    In response, Xu argued THORChain should not be compared with Bitcoin or Ethereum. He said validators jointly control assets in vaults through a threshold-signing system. “I don’t think THORChain’s TSS + validator model represents true decentralization,” he wrote. “The selected validators set collectively controls the underlying assets in the TSS vaults. Once the signing threshold is reached, those validators can move the funds.”

    Under that model, a required group of validators can authorize transfers. Xu said this makes THORChain an intermediary, even though no single validator controls a vault.

    THORChain’s official account rejected that characterization, describing the network as decentralized and permissionless. It also questioned whether base-layer blockchains should face similar demands when stolen assets pass through them.

    Stablecoin Freezes and Recovery Efforts

    Circle and Tether froze roughly $318,000 in USDC and USDT at a wallet linked to the Bitget attack. The wallet held about 99,990 USDC and 218,023 USDT when the issuers blocked the tokens. Those issuer controls can stop stablecoin movement, but they do not give Circle or Tether control over Ethereum held at the same address.

    Bitget has also launched a recovery bounty program, offering eligible parties 5% of affected funds they help freeze or recover. The exchange published attacker addresses and a live tracing dashboard for firms monitoring the transfers.

    The confirmed freeze represents only a small portion of the $387.5 million estimate. Further recovery depends on where the assets move and whether the services handling them can restrict transfers. Bitget’s September 28 update is expected to provide more details on the investigation and withdrawal restoration.

  • OKX Founder Challenges THORChain’s Decentralization Claims After $387.5M Bitget Exploit

    OKX Founder Challenges THORChain’s Decentralization Claims After $387.5M Bitget Exploit

    OKX founder Star Xu has publicly questioned THORChain’s claim that it operates as a fully decentralized blockchain, after funds connected to the Bitget hack were reportedly moved through the cross-chain network. The dispute highlights the growing tension between permissionless infrastructure and efforts to freeze stolen crypto assets.

    Bitget has raised its confirmed loss estimate to approximately $387.5 million following unauthorized transfers detected at 18:31 UTC on September 24. The exchange has asked industry participants, including THORChain, to help block assets tied to the attacker.

    Bitget revises loss estimate upward

    Bitget initially estimated the affected amount at $351.6 million and temporarily paused withdrawals after spotting suspicious activity in some hot wallets. The exchange said cold wallets were not compromised and its protection fund held more than $464 million.

    After further tracing, Bitget revised the total to $387.5 million. The new figure includes Zcash and Tron transfers that were not part of the initial calculation, not new transactions after the breach was contained. The exchange said Mandiant and SlowMist are assisting with the investigation.

    Bitget has published a restoration schedule for withdrawals: Bitcoin is expected to resume on September 28, Ethereum on September 29, and USDT on September 30. Other tokens, fiat withdrawals, and peer-to-peer services are slated for October 2. The exchange stressed these dates are a schedule, not confirmation that services have resumed.

    Decentralization dispute intensifies

    Bitget CEO Gracy Chen asked THORChain to refuse transactions from addresses linked to the attacker. That request triggered a broader debate about whether THORChain’s validators can act on publicly flagged wallets.

    Star Xu argued that THORChain’s threshold-signature scheme (TSS) and validator model do not represent true decentralization. He said the selected validator set jointly controls assets held in vaults, and once the signing threshold is reached, those validators can move funds. From a custody perspective, he contends, THORChain acts as an intermediary even if no single validator controls a vault.

    THORChain’s official account rejected that interpretation, describing the network as decentralized and permissionless. It questioned whether base-layer blockchains should be expected to censor transactions when stolen assets pass through them. The two sides remain divided on both THORChain’s level of control and its responsibility in recovery efforts.

    Stablecoin freezes and recovery bounty

    Circle and Tether froze approximately $318,000 in USDC and USDT at a wallet linked to the Bitget attack. The wallet held roughly 99,990 USDC and 218,023 USDT when the issuers blocked the tokens. These issuer-level controls can stop those stablecoins from moving, but they do not give Circle or Tether control over Ethereum held at the same address.

    Bitget has also launched a recovery bounty program, offering eligible parties 5% of affected funds they help freeze or recover. The exchange published attacker addresses and a live tracing dashboard for firms monitoring the transfers.

    The confirmed freeze accounts for a small fraction of the $387.5 million estimate. The final recovery outcome will depend on where the assets move and whether the services handling them can impose transfer restrictions. Bitget’s next scheduled update on September 28 is expected to cover both the investigation and withdrawal restoration.