The cryptocurrency landscape is once again grappling with a fundamental tension: the promise of decentralized, permissionless finance versus the urgent need to address illicit activities and protect users. The recent $387.5 million exploit of crypto exchange Bitget has ignited a heated debate, pitting the operational principles of decentralized protocols against the demands for accountability from centralized entities. Investigators have successfully traced the stolen funds to specific recipient addresses, a crucial step in the pursuit of recovery. However, the subsequent call by Bitget CEO Gracy Chen for THORChain, a decentralized cross-chain swaps platform, to refuse service to these addresses has exposed the deep chasm between different factions within the crypto ecosystem.
The Bitget Hack and the THORChain Standoff
Last week’s massive exploit at Bitget, a prominent cryptocurrency exchange, sent shockwaves through the industry. While the precise method of the hack is still under scrutiny, the immediate aftermath saw investigators meticulously tracking the flow of the stolen $387.5 million. The success in identifying the recipient wallets presented a clear path for potential recovery, but it also presented a moral and technical quandary for decentralized finance (DeFi) protocols.
Bitget CEO Gracy Chen publicly urged THORChain to take action, requesting that the platform block transactions originating from the identified hacker wallets. This appeal, however, was met with a firm stance from THORChain, which articulated its core principles in a pointed response: "THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?"
This assertion highlights the philosophical underpinnings of many DeFi protocols. They are designed to operate without central authorities, mimicking the open and censorship-resistant nature of foundational blockchains like Bitcoin. The implication is clear: if these foundational layers are not expected to police transactions, then protocols built upon similar principles should not be compelled to do so either.
Decentralization as a Shield: A Legal Defense?
The controversy surrounding Bitget’s request to THORChain delves into complex legal territory. Yuriy Brisov, a legal expert from D&A Partners, offered critical insights into the implications of such demands and the defenses available to DeFi protocols. Brisov explained that a protocol’s claim of decentralization serves as its primary legal shield. "When they do this – when they block some addresses – they show that their nodes aren’t truly decentralized," Brisov stated. "It’s good for the community, when they can use this power to prevent some malicious activities. However, at the same time, they open themselves to any other legal claim. Their only protection is ‘we are decentralized.’"
The legal precedent for this defense was exemplified in the Uniswap case. Investors had sued Uniswap, alleging that the decentralized exchange facilitated numerous "rug pulls" and scams. However, a judge ultimately dismissed the case, largely on the grounds of Uniswap’s decentralized nature, which meant it lacked the centralized control necessary to be held liable for the actions of its users. "In the Uniswap case, they said ‘we are truly decentralized and there is nothing we can do’," Brisov recalled. "And this is the strongest defense for any DeFi protocol."
The critical distinction, according to Brisov, lies in the ability of a protocol to interfere with or control transactions. If a DeFi platform demonstrates the capacity to block, control, or otherwise interfere with transactions – even with the laudable intention of preventing fraud – it risks undermining its decentralized status in the eyes of the law. Such actions, however well-intentioned, can open the door to claims that the platform should have exercised more diligence, perhaps by implementing Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures akin to those on centralized exchanges.
The NEAR Intents Approach: A Different Path
In contrast to THORChain’s principled refusal, NEAR Intents has taken a different, albeit controversial, approach. Its automated SHIELD program proactively blocked addresses linked to the Bitget hack, preventing them from swapping approximately $50 million on the platform. Notably, NEAR Intents even declined a 5% bounty offered by Bitget for this action.
This proactive stance, while seemingly beneficial for security, has drawn criticism from "decentralization maxis" who argue that such interventions compromise the permissionless nature of the protocol. The very act of blocking specific addresses, regardless of the justification, raises questions about the extent of NEAR Intents’ decentralization.
Brisov elaborated on the implications of NEAR’s actions: "If you show that you have control over assets, then you potentially open yourself to all potential claims regarding pump-and-dump schemes, volatility, or any other potential claims of any investors who somehow have been damaged and harmed." He further questioned the selective application of such control: "Why do you use it in one case and not use it in another case? Why don’t you check all your token issuers on your platform? Why don’t they provide KYC forms like on any centralized exchange?" This suggests that by taking action in one instance, NEAR Intents may have inadvertently set a precedent for future interventions and increased its potential legal exposure.
THORChain’s Past and Technical Limitations
The debate is further complicated by THORChain’s own history. The protocol experienced a significant exploit in May, resulting in the loss of $10.7 million of its own funds, which led to an immediate halt in operations. This past vulnerability adds a layer of irony to the current situation, as the platform now finds itself on the receiving end of demands to police illicit funds.
Moreover, THORChain has strategically retired its administrative key. This decision, aimed at enhancing decentralization and security by preventing any single entity from making unilateral changes, means the protocol lacks an easy mechanism to censor addresses, even if it were inclined to do so. This technical limitation reinforces THORChain’s argument that it is fundamentally incapable of complying with Bitget’s request.
This situation is not unprecedented for THORChain. The platform was previously used to swap approximately $1.2 billion of funds stolen in the massive $1.46 billion hack of Bybit. Coincidentally, THORChain had retired its administrative key just 11 days prior to that incident, further solidifying its stance on decentralization and its inability to intervene.
The Nuance of Automated Systems
The legal implications can hinge on the technical implementation of any intervention. Brisov noted that an automated system, such as an oracle designed to detect and block IP addresses associated with specific malicious actors, might be viewed differently by regulators than a manual intervention. "Say there is an oracle that can detect any North Korean IP and block it automatically, and there is no person who sits and presses a button – ‘there’s a North Korean hacker, let’s block him.’ Then it’s okay," he explained.
However, if a team actively monitors the situation and manually decides to block specific addresses, even with good intentions, it fundamentally alters the legal perception of the protocol. "From the legal point of view, even though it’s a good act and it benefits the community, it still makes the project not fully decentralized from the legal perspective, and it strips you of the protection that regulations like MiCA [EU’s Markets in Crypto Assets laws] or the general understanding the SEC and CFTC provide that if you’re fully decentralized, you cannot be liable for the actions of the participants in your ecosystem."
In this context, NEAR Intents’ SHIELD program, being an automated process that identifies and blocks addresses linked to known hacks without manual oversight, is likely to be viewed more favorably from a decentralization standpoint. "Definitely," Brisov affirmed when asked if NEAR’s automated system makes it more likely to be seen as decentralized. "They show that they are good-faith actors trying to [add] protective measures into their protocols. There is no compliance team, people who sit there and control the operation manually. This is a smart solution, and that’s what we recommend to all the DeFi companies."
The Future of Decentralization and Liability
The retirement of THORChain’s admin key and the presence of a hundred validators suggest a high degree of decentralization, making it "more likely than not" that the protocol is sufficiently decentralized to avoid liability. However, Brisov cautioned that without direct legal challenges, certainty remains elusive.
The question of whether THORChain is liable for receiving stolen goods, rather than money laundering, is also pertinent. Brisov argued that THORChain, like Tornado Cash, is unlikely to be liable for money laundering. His reasoning centers on the legal definition of property and control. In the U.S., money laundering involves illegally moving property through legal channels. Smart contracts, however, are not considered property in the same way; they are not controlled or owned by any single entity. This lack of control was instrumental in Tornado Cash’s legal defense against OFAC sanctions.
Despite the significant time elapsed since the Bybit hack 18 months ago, Brisov acknowledged that legal action against platforms like THORChain could still materialize in the future. The Bybit case, in particular, "seriously opened themselves for potential claims," he noted.
The ongoing saga surrounding the Bitget hack and the differing responses from THORChain and NEAR Intents underscore a critical juncture for the cryptocurrency industry. As DeFi protocols mature, the balancing act between maintaining their decentralized ethos and responding to legitimate concerns about illicit activities will continue to be a defining challenge. The legal ramifications of these choices are only beginning to unfold, and the industry watches closely to see how these complex issues will be resolved. The pursuit of truly decentralized and permissionless financial systems must now contend with the practical realities of preventing criminal exploitation, navigating a complex legal landscape, and ensuring the long-term trust and viability of the crypto economy.
