THORChain Validators Face Delays in Impeding Bitget-Linked Funds

THORChain co-founder Chad Barraford revealed that efforts to impede funds linked to the Bitget security incident could take several days due to the time required to coordinate validators. The protocol’s current measures, such as trading pauses, affect the entire network rather than targeting specific wallets.

Bitget updated its estimate of stolen funds to approximately $387.5 million, an increase from the earlier $351.6 million, now including assets on the Zcash and Tron networks. Some actions on THORChain require approval from two-thirds of validators, a process that typically takes about three days and can extend to two weeks, potentially allowing stolen funds to move to other addresses.

Under the protocol’s security rules, a single node can pause trading for up to 720 blocks, roughly an hour, but other nodes can extend this pause. However, this affects all trading on THORChain, not just the wallet linked to the incident. Barraford noted that stopping swaps already in progress could require a vault migration, another action that requires validator approval and may take one to two weeks.

The situation highlights the tension between impeding the movement of stolen funds and avoiding disruption to legitimate users. Barraford suggested that validators could approve stronger measures if enough supported a change. Meanwhile, onchain investigator Taylor Monahan advocated using existing mechanisms to make laundering harder. THORChain’s emergency halt is a network-wide circuit breaker, and the protocol cannot selectively block an individual address.