The cryptocurrency industry is grappling with a fundamental question of its ethos following the recent Bitget hack, which saw hundreds of millions in stolen funds rapidly move across blockchain networks. The incident has thrust decentralized cross-chain swap platform THORChain into the spotlight, igniting a fervent debate between those advocating for a proactive stance against illicit fund flows and proponents of absolute permissionless technology.
On September 24th, Bitget, a prominent cryptocurrency exchange, experienced a significant security breach, resulting in the loss of approximately $387.5 million worth of digital assets. In the immediate aftermath, these stolen funds began a swift journey across various blockchain ecosystems, with a notable portion appearing on THORChain, a protocol designed for seamless asset exchange between different blockchains without intermediaries.
Bitget CEO Gracy Chen publicly addressed the situation, appealing directly to THORChain to refuse service to addresses linked to the attackers. Her plea, disseminated via social media, underscored the industry’s watchful gaze on the platform’s response. "The industry is watching," Chen stated, highlighting the gravity of the situation and the precedent that THORChain’s decision might set. However, THORChain opted not to intervene, adhering to its core principle of being a permissionless protocol. This refusal has catalyzed a profound ideological schism within the crypto community, pitting the practical need for security and asset protection against the foundational cypherpunk ideals of decentralized and censorship-resistant technology.
THORChain’s stance is not entirely unexpected, especially given its prior experience with large-scale illicit fund movements. The platform had previously facilitated the transfer of approximately $1.2 billion through its protocol following a hack on Bybit, another exchange. This history provides a clear indication of THORChain’s commitment to its decentralized architecture. Boone Wheeler, a developer associated with THORChain, articulated this philosophy to Magazine, stating, "A truly permissionless protocol can do nothing when it encounters known stolen funds – it is blind to their provenance. If THORChain were able to block specific stolen funds, it would not be permissionless." This assertion places THORChain firmly on the side of unwavering decentralization, even when faced with the consequences of facilitating the movement of illicit assets.
The core of the disagreement lies in the interpretation and application of "permissionlessness." Critics argue that THORChain’s adherence to this principle, while theoretically sound, creates a moral and practical dilemma when faced with substantial theft. They contend that protocols, especially those handling significant financial flows, have a responsibility to implement safeguards against exploitation.
The Question of Intervention: When Does Permissionlessness End?
The debate surrounding THORChain’s refusal to block stolen funds from the Bitget hack is further complicated by its own past actions. In May, THORChain validators voted to temporarily halt the chain following an exploit that drained over $10 million from one of its vaults. This decision, triggered by an automated system detecting a vulnerability, was seen by some as a deviation from absolute permissionlessness, as it involved an intervention to protect the protocol’s integrity. Critics point to this event as evidence that THORChain is not entirely ideologically pure in its commitment to an uncensored system, suggesting that the platform possesses the capability to intervene when it deems necessary.
In stark contrast to THORChain’s approach, NEAR Protocol, through its NEAR Intents and its automated security layer SHIELD, took a proactive stance in the Bitget hack incident. NEAR Intents, a competitor to THORChain in the cross-chain transaction space, intervened to block funds linked to the hack. Its SHIELD system reportedly identified over $50 million in attempted flows related to the Bitget exploit, successfully stopping $503,000 in transactions, while acknowledging that $166,000 managed to pass through. NEAR also waived its share of Bitget’s recovery bounty, demonstrating a commitment to assisting in the recovery process.
Alex Shevchenko, General Manager of NEAR, explained their rationale: "NEAR Protocol is permissionless: anyone can build on it, transact on it, and become a validator… No one needs permission to hold or transfer assets or deploy contracts on NEAR Protocol. However, that does not mean every application built on NEAR must process every request." This statement draws a crucial distinction between the permissionless nature of the underlying protocol and the selective filtering capabilities of applications built upon it.
NEAR Intents’ intervention, however, has also drawn criticism, with some arguing that it compromises its own claims of being permissionless and decentralized. This opens NEAR up to potential scrutiny regarding the broader application of its intervention capabilities. Nevertheless, crypto lawyer Yuriy Brisov suggests that NEAR Intents might still be protected under existing regulations for decentralized protocols due to SHIELD being an automated system. "There is no compliance team, people who sit there and control the operation manually. This is a smart solution, and that’s what we recommend to all the DeFi companies," Brisov noted. This perspective suggests that automated, rule-based interventions, even if they block transactions, might be viewed differently than manual censorship.
The Nuance of Permissionless Infrastructure
Bitget CEO Gracy Chen acknowledged that different protocols have varying architectural designs, governance models, and technical capabilities. However, she emphasized a critical distinction between "permissionless infrastructure" and "facilitating the movement of known stolen funds." She lauded NEAR Intents’ response, stating, "We appreciate that response and will follow the appropriate legal and recovery process for those assets."
Chen’s perspective suggests that the industry should explore mechanisms for identifying and responding to illicit fund flows, even within permissionless frameworks. "Permissionless infrastructure does not necessarily mean there can be no mechanisms for detecting and responding to known illicit flows," she asserted. This viewpoint advocates for a more nuanced understanding of permissionlessness, one that doesn’t preclude the implementation of security and integrity measures.
THORChain’s own post-mortem report on the May exploit highlights its ability to intervene in emergency situations. The report indicated that the protocol automatically halts activity upon detecting insolvency events, and node operators can then utilize broader emergency controls to pause trading and other network activities. This capability, critics argue, contradicts the notion that THORChain is entirely incapable of intervention.
However, Wheeler maintained that there is a "firm consensus" among THORChain’s nodes to uphold the ideal of being permissionless. He reiterated that "halts are only used when there is an active issue or problem with the protocol." Crucially, he stated that the system "has no functionality to screen individual addresses or transactions," emphasizing that this is an intentional design choice aimed at preserving its "truly permissionless" nature.
NEAR Intents: A Contrasting Model of Financial Integrity
While THORChain embodies the purist cypherpunk ideal, NEAR Intents operates within a more pragmatic middle ground. NEAR, which has seen the establishment of a Bitwise ETF, presents a different philosophical approach, integrating robust financial integrity measures alongside its open participation framework.
Shevchenko explained that SHIELD was engineered to "automatically apply targeted controls to supported flows." In the case of the Bitget hack, SHIELD leveraged public on-chain data, internal anti-money laundering (AML) databases, and third-party intelligence providers to identify suspicious activities. "SHIELD not only protects NEAR Intents but the whole cross-chain ecosystem it serves," Shevchenko stated. "Every major hack drains capital and activity from the onchain economy, so screening for stolen funds and restricting money laundering helps protect the integrity of the wider blockchain economy."
The effectiveness of SHIELD was further demonstrated when it identified suspicious behavior behind a separate $3.8 million Omni deposit/withdrawal exploit, halting the activity. Chen reiterated the importance of cooperation within the ecosystem when stolen funds can be reliably identified, suggesting a spectrum of possible actions, including tracing, information sharing, transaction declines, asset freezing where infrastructure permits, and supporting legal recovery processes.
The Cost of Drawing a Line in the Sand
Joël Valenzuela, a libertarian, cypherpunk, and head of business and development for Dash, staunchly defends the absolute interpretation of permissionlessness. "Permissionless protocols, quite frankly, should not draw the line anywhere when stolen funds are identified, because being able to do so at all makes them permissioned," he argued. Valenzuela acknowledged the difficulty of witnessing stolen funds move freely but cautioned that any ability to intervene "opens up Pandora’s Box" and "lets all manner of censorship of innocents eventually happen." He believes that the onus of security should primarily lie with centralized exchanges, which he argues need to "take their security much more seriously," ultimately advocating for decentralized exchanges (DEXs) as the future.
Max Shannon, senior research associate at Bitwise Europe, offered a different perspective, suggesting that protocols still in their nascent stages, such as THORChain and NEAR, must earn trust. He characterized refusing to process hack proceeds as a "sound stance." Shannon posited that THORChain’s actions might inadvertently lead to more illicit fund flows being directed towards it, as it remains a more permissive option compared to NEAR Intents.
Shannon further elaborated on the philosophical divide: "’Credible neutrality at all costs,’ is a cypherpunk ideal that a small faction of crypto users and builders still champion. They rarely ask why it is valuable, when it is valuable, or what it costs. This is the core difference between NEAR Intents and THORChain." This highlights that while the ideal of neutrality is cherished by some, its practical implications and costs are becoming increasingly apparent as the crypto ecosystem matures and faces real-world security challenges.
The debate surrounding the Bitget hack and THORChain’s response underscores a critical juncture for the cryptocurrency industry. As the value locked in decentralized finance (DeFi) continues to grow, so too does the incentive for malicious actors. The tension between maintaining an uncensored, permissionless network and implementing safeguards against theft and illicit financial activity will likely remain a central challenge, shaping the future architecture and ethical framework of blockchain technology. The decisions made by platforms like THORChain and NEAR Intents are not merely technical; they are philosophical, setting precedents for how decentralized systems will interact with the broader financial and legal landscape. The industry is indeed watching, and the lines drawn today will define the boundaries of decentralization for years to come.
