OKX founder Star Xu has publicly questioned THORChain’s claim to true decentralization after funds linked to the Bitget security breach reportedly moved through the cross-chain network. The exchange now estimates the attacker made off with approximately $387.5 million and is asking industry partners to help block the stolen assets.
Bitget Raises Loss Estimate to $387.5 Million
On September 24, Bitget detected unauthorized transfers from certain hot wallets at 18:31 UTC. The exchange initially placed the damage at $351.6 million and paused withdrawals, while noting that cold wallets remained secure and its protection fund held more than $464 million.
After further tracing, Bitget revised the amount sent to attacker-controlled addresses to $387.5 million. The update included Zcash and Tron transfers that were omitted from the initial figure; it did not reflect new transfers after the breach was contained. Mandiant and SlowMist are assisting with the investigation.
Withdrawal restoration is scheduled in stages: Bitcoin on September 28, Ethereum on September 29, USDT on September 30, and other tokens, fiat withdrawals, and peer-to-peer services on October 2. Bitget stressed these dates are a restoration schedule, not confirmation that withdrawals have resumed.
Star Xu Questions THORChain’s Validator Model
Bitget CEO Gracy Chen asked THORChain to refuse transactions from addresses linked to the attacker. That request highlighted the network’s role in moving assets between blockchains and raised questions about whether its operators can act on publicly flagged wallets.
In response, Xu argued THORChain should not be compared with Bitcoin or Ethereum. He said validators jointly control assets in vaults through a threshold-signing system. “I don’t think THORChain’s TSS + validator model represents true decentralization,” he wrote. “The selected validators set collectively controls the underlying assets in the TSS vaults. Once the signing threshold is reached, those validators can move the funds.”
Under that model, a required group of validators can authorize transfers. Xu said this makes THORChain an intermediary, even though no single validator controls a vault.
THORChain’s official account rejected that characterization, describing the network as decentralized and permissionless. It also questioned whether base-layer blockchains should face similar demands when stolen assets pass through them.
Stablecoin Freezes and Recovery Efforts
Circle and Tether froze roughly $318,000 in USDC and USDT at a wallet linked to the Bitget attack. The wallet held about 99,990 USDC and 218,023 USDT when the issuers blocked the tokens. Those issuer controls can stop stablecoin movement, but they do not give Circle or Tether control over Ethereum held at the same address.
Bitget has also launched a recovery bounty program, offering eligible parties 5% of affected funds they help freeze or recover. The exchange published attacker addresses and a live tracing dashboard for firms monitoring the transfers.
The confirmed freeze represents only a small portion of the $387.5 million estimate. Further recovery depends on where the assets move and whether the services handling them can restrict transfers. Bitget’s September 28 update is expected to provide more details on the investigation and withdrawal restoration.
