Investigators say they were able to quickly identify and trace recipient addresses after suspected North Korean hackers exploited crypto exchange Bitget for $387.5 million last week. Bitget then urged decentralized cross-chain swaps protocol THORChain to “refuse service” to those addresses—an ask THORChain rejected on the grounds that it is permissionless like major public blockchains.

The dispute has reignited a broader legal and philosophical debate in DeFi: whether decentralized protocols should block funds tied to hacks, and what liability risks arise when they can (or cannot) selectively interfere. The controversy echoes earlier moments, including THORChain’s use in routing around large stolen-fund incidents, and an opposing approach from NEAR’s Intents ecosystem, which uses an automated program to stop address-based access.

Key takeaways

Bitget requested THORChain to block addresses tied to suspected North Korean stolen funds; THORChain rejected the idea as inconsistent with permissionless operation.
Legal analysis in the conversation highlights that any ability to block or control transactions can weaken a protocol’s “we’re decentralized” defense.
Automated, rule-based blocking (as described for NEAR Intents’ SHIELD) may be viewed more favorably than manual intervention from a decentralization-liability standpoint.
Even protocols that are not “mixers” can still face claims depending on how laws define control, property, and illicit proceeds.

Why Bitget’s request sparked a legal debate

After the alleged Bitget hack, Bitget’s CEO, Gracy Chen, demanded that THORChain refuse service to the flagged recipient addresses. THORChain responded that, as a decentralized and permissionless system, it operates like networks such as Bitcoin, Ethereum, and BNB Chain, and argued it bears no responsibility comparable to those ecosystems for transactions involving known stolen funds.

The backlash was sharpened by THORChain’s own history of halts: the protocol was stopped in May after $10.7 million of its own funds were exploited. The immediate point of friction, however, is not only operational capability—it’s legal exposure. If a protocol can block certain addresses, does that mean it should? And if it doesn’t, could that become negligence or recklessness in a future claim?

What the legal risk looks like when protocols can block

In an edited conversation with Yuriy Brisov of D&A Partners, the central legal tension was framed around how courts might interpret “decentralization” when a DeFi protocol demonstrates it can interfere.

“It depends on the level of decentralization. So when they do this — when they block some addresses — they show that their nodes aren’t truly decentralized… Their only protection is ‘we are decentralized.’”

The argument goes both directions. If a protocol blocks addresses, it signals some level of control or operational ability, potentially inviting claims that it should have acted more broadly or applied safeguards consistently. Conversely, if a protocol claims it is too decentralized to intervene, the same line of reasoning can still appear in court—especially if any technical mechanism exists that can be used to stop specific activity.

Brisov pointed to how defenses have played out in other contexts, referencing a prior Uniswap case mentioned in the conversation. In that dispute, investors alleged the platform facilitated “rug pulls” through token trading, and the case was dismissed in March by a judge—illustrating that outcomes can hinge on how courts treat platform control and causation.

For DeFi teams, the practical takeaway is that “we can’t help” is not automatically stronger than “we can help,” because proving a capability to block can create new theories of liability—such as whether the protocol should apply protective measures beyond obviously fraudulent cases.

THORChain’s admin-key retirement and the “can it really refuse?” question

THORChain’s position also hinges on its ability to act. The article notes that THORChain retired its admin key—an operational change that, in theory, reduces unilateral control and makes address-level censorship difficult.

“More likely than not, but we can’t say that for sure. I would say yes.”

The legal analysis suggested that the absence of such keys may help, but it doesn’t remove uncertainty. The conversation emphasized that “any amount of control makes any DeFi project weaker vis-à-vis any claimant.” That means the issue likely turns on what can be technically achieved today, what would be required to enforce a block, and whether that process involves discretion by humans.

There was also a key distinction: the legal assessment may change depending on how address blocking could be implemented. If an automated system detects illicit activity and blocks it without human judgment, that could be treated differently than a setup where operators can selectively press buttons after reviewing the situation.

Brisov’s framing was that even a good-faith attempt to prevent harm could still impact liability analysis, because it may be interpreted as evidence that the protocol can effectively control outcomes—potentially affecting how regulators and courts view responsibility under approaches such as MiCA or in terms of how the SEC and CFTC treat fully decentralized systems.

NEAR Intents and SHIELD: automation instead of discretion

While THORChain faced pressure to block the flagged addresses, NEAR Intents took what the article describes as the opposite approach. Its automated SHIELD program blocked addresses linked to known hacks from swapping on the Intents platform, reportedly even declining a 5% bounty Bitget was offering for performing such blocking.

That difference is important to the legal analysis. Brisov argued that automation with no compliance team or operators pressing manual controls is generally more consistent with decentralization principles:

“Definitely. They show that they are good-faith actors trying to [add] protective measures into their protocols. There is no compliance team… This is a smart solution, and that’s what we recommend to all the DeFi companies.”

In other words, the analysis suggests that the more “procedural” and less discretionary the mitigation is, the easier it may be to defend as protective infrastructure rather than an implicit assertion of centralized power. That nuance is likely to matter if the question of liability ever reaches a courtroom: not just whether a protocol can block, but how the mechanism works and who—or what—decides.

Stolen-funds swapping: not a mixer, but still an open question

The legal discussion also touched on whether THORChain can be implicated when it routes stolen assets through swaps while preserving transparent links on-chain. The article emphasizes that THORChain is not a mixer in the classic sense: stolen funds can be swapped, but the resulting funds remain linked to the source activity in a traceable way.

Brisov argued that liability for money laundering is not straightforward in such a model, drawing an analogy to Tornado Cash and the way it defended itself. The conversation stated that American law treats “property” differently in ways that affect money-laundering theories, and that immutable smart contracts have been treated as not giving operators control over specific “property” in that context.

However, the broader implication is that “not a mixer” does not eliminate legal scrutiny. Even if the intent is protection against illicit activity, the availability of intervention mechanisms—and the perceptions they create—can still lead to legal exposure under theories unrelated to laundering, including negligence or failure to implement appropriate safeguards.

As for timing, the conversation noted that the Bybit hack referenced in the article occurred about 18 months ago and that legal action could still materialize, though it may take time. The risk is that once a protocol is perceived to have potential control or discretion—even indirectly—future claims can be structured around that perceived capability.

Going forward, investors and builders should watch two things closely: whether protocols can demonstrate mitigation processes that are automated and rule-based rather than operator-driven, and whether courts or regulators continue to treat “decentralization” as a binary concept or a spectrum shaped by technical control and practical discretion.