THORChain Validator Votes Can Take Days to Slow Bitget-Linked Funds

THORChain co-founder Chad Barraford said coordinating validators to impede funds linked to Bitget’s September security incident can take days, while the protocol’s trading pauses affect the network broadly rather than one wallet.

Bitget put the amount transferred to attacker-controlled addresses at about $387.5 million, revising its earlier estimate of $351.6 million. The updated figure included assets on the Zcash and Tron networks.

Some THORChain actions require approval from two-thirds of validators. Barraford said that coordination takes about three days on average and can extend to two weeks, giving funds time to move to other addresses.

A single node can pause trading for up to 720 blocks, or roughly an hour, under the protocol’s security rules. Other nodes can extend the pause, but it affects trading across THORChain rather than targeting an individual wallet.

Stopping swaps already in progress could require a vault migration, Barraford said. That action also requires approval from two-thirds of validators and may take one to two weeks.

The dispute reflects a tension between impeding the movement of stolen funds and avoiding disruption to legitimate users. Barraford said validators could approve stronger measures if enough supported a change, while onchain investigator Taylor Monahan advocated using existing mechanisms to make laundering harder.

THORChain’s emergency halt is a network-wide circuit breaker, and the protocol cannot selectively block an individual address.