Chad Barraford: THORChain halts for its own bugs, not for Bitget's hacker

Chad Barraford, co-founder and technical lead of THORChain, argued on The Defiant: THORChain Refused to Block the $387M Bitget Hacker. Here's Why | Chad Barraford, published 26 October 2026, that THORChain could not have blocked in time the swaps that moved roughly $387.5 million stolen from the exchange Bitget, and that its validators would not halt trading to do so. The host pressed him on why THORChain, which has halted trading to contain its own exploits, would not do the same to block an outside hacker's funds. Asked whether he had measured how much illicit money flows through THORChain, he gave an assumption rather than a figure. The dispute matters because it turns a specific, named theft into a test of whether a decentralized protocol's stated inability to act is a technical limit or a choice.

The argument

Barraford's core answer was about timing. Validator consensus to block a specific wallet, he said, "would take on average three days, maybe up to maybe up to two weeks potentially depending upon the situation" (from 6:37), long after any individual swap has already settled.

Pressed on why the halt THORChain uses for its own exploits could not be used against Bitget's hacker, he said the obstacle was agreement, not capability: "the protocol has the ability to pause trading fairly quickly to protect itself from loss itself, like protocol Thorchain's loss, that is. But you probably just can't get consensus amongst the nodes to agree in that scenario." (from 28:12) Had he asked validators to pause for Bitget, he said, "nobody would probably vote to pause trading in that scenario" (from 30:06).

Asked what contact THORChain actually had with Bitget, Barraford said: "I never spoke to the people at Bitget personally. I don't think any of the validators or operators did. I think that what was considered the official request was just sending out a tweet" (from 16:34).

Later, pressing him on his claim that illicit funds make up only a small share of THORChain's volume, the host asked: "Have you actually run those analyses? How much do you estimate is stolen funds?" (from 44:16) Barraford answered: "I would assume it to be one percent, maybe no larger than two. I'd be surprised if it was more than two." (from 44:22)

What it rests on

Bitget put its loss from the 24 September 2026 breach at $387.5 million transferred to attacker-controlled addresses, revised up from an initial estimate of about $351 million. CEO Gracy Chen told Cointelegraph the attacker exploited a vulnerability in a third-party security product that yielded high-level internal credentials, used to issue fraudulent withdrawal commands; Bitget's private keys and cold wallets were not touched. Cointelegraph reported that on-chain trackers Lookonchain and Arkham showed ether tied to the attacker flowing into THORChain vaults and being swapped there for bitcoin.

Barraford's account of the request matches Bitget's own record of it. Chen posted on X two days after the breach: "Our attacker addresses are publicly listed and actively tracked. We are formally asking Thorchain to refuse service to these addresses," adding, "Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching."

THORChain's official account replied the same day, writing in part: "[Thorchain] is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?" Two days later, Chen gave Cointelegraph a narrower account of what Bitget had actually asked for: "We understand that THORChain operates as a decentralized protocol and has said that it cannot selectively blacklist individual addresses. We respect the technical constraints of different networks and are not asking any protocol to take actions that are not technically possible."

Barraford raised the closest precedent himself: after the 2025 Bybit hack, he said, validators who wanted to halt "lost by a landslide" (from 16:56). Bitcoin.com reported that three of the protocol's validators voted to halt ether trading under pressure after that theft, four reversed the decision roughly half an hour later, and the network kept running, with a developer quitting over the outcome. A separate figure from that same hack shows how large a single theft's share of THORChain's volume can look in the days right after it: Bybit CEO Ben Zhou said in March 2025 that 72% of the stolen ether, 361,255 ETH, had flowed through THORChain. That measures one hack's proceeds, not THORChain's lifetime volume. No independent forensic estimate of THORChain's lifetime illicit-volume share was found to check his number against directly.

Where it was discussed

• The Defiant: THORChain Refused to Block the $387M Bitget Hacker. Here's Why | Chad Barraford, 26 October 2026, from 6:37