THORChain Refused to Block a $387M Hacker. Then It Lost $10.7M Itself.

THORChain Refused to Block a $387M Hacker. Then It Lost $10.7M Itself.

THORChain looked a $387.5 million hack in the face and said: not our problem.

When Bitget was drained of $387.5 million in one of crypto's largest exchange hacks, the team did what any rational actor would do: they contacted major DeFi protocols and asked them to block the attacker's addresses. THORChain, the decentralized cross-chain liquidity protocol, flatly refused.

The reasoning was ideological. THORChain operates as a permissionless, censorship-resistant protocol. Blocking specific addresses, even those tied to a nine-figure theft, would mean making a governance decision to act as an arbiter of on-chain activity. The team said no on principle.

Then the receipts started arriving.

Weeks after the refusal, Tether froze four THORChain vaults on Tron holding 1.45 million USDT. The freeze lasted three hours before the funds were unfrozen, but the signal was impossible to ignore: centralized stablecoin issuers can and will reach into DeFi infrastructure when they choose to. THORChain's censorship resistance had a ceiling, and Tether just found it.

Then came the GG20 exploit. In May, THORChain itself was hit by a vulnerability tied to the GG20 cryptographic signing scheme, resulting in a $10.7 million loss. The protocol that refused to act against a hacker became the protocol that got hacked.

This is not coincidence. This is the core tension of DeFi in 2025.

Protocols that hold the censorship-resistance line face external pressure from regulators and stablecoin issuers with real leverage. Protocols that compromise on censorship resistance lose the one thing that justifies their existence over centralized alternatives. There is no clean answer here, and THORChain is now living inside that contradiction in real time.

For cross-chain liquidity protocols specifically, the GG20 flaw is a technical alarm worth understanding. GG20 is a threshold signature scheme used to secure vaults holding real assets across chains. If the cryptographic layer has exploitable flaws, the entire security model of cross-chain bridging is exposed, not just for THORChain but for any protocol using similar primitives.

What to watch: THORChain's governance response to both the hack and the Tether freeze will be the tell. If the protocol moves toward any form of address screening, it signals that censorship resistance is negotiable under enough pressure. If it holds firm, expect regulators and stablecoin issuers to escalate. Either outcome reshapes how DeFi liquidity infrastructure gets priced and used.

DeFi users routing large cross-chain swaps should monitor THORChain's vault security updates closely before moving significant size.