THORChain’s decision not to selectively block addresses linked to the Bitget theft has intensified a longstanding legal debate over who, if anyone, can be held responsible when illicit funds move through permissionless DeFi infrastructure. The dispute creates potential regulatory questions around identifiable control, but no public enforcement action against THORChain or its operators has been announced. The distinction matters because using a protocol for laundering does not by itself establish criminal responsibility for the people who developed or operate parts of it.
The debate follows Bitget’s September breach, which resulted in approximately $387.5 million reaching attacker-controlled addresses, although only a fraction of that total has been publicly identified as passing through THORChain. The protocol’s response has drawn attention because it previously demonstrated extensive emergency capabilities during its own May 15 exploit. THORChain can halt network activity, trading, signing or operations involving specific chains, but those controls are not equivalent to maintaining an address-level blacklist. Its official emergency procedures place those powers primarily with node operators through automatic safeguards, pauses and Mimir voting.
Control Becomes the Critical Regulatory Question
The May incident nevertheless establishes that THORChain is not operationally immutable. After an attacker exploited vulnerabilities in its GG20 threshold-signature implementation and drained approximately $10.7 million from one vault, automated systems halted affected chains before nodes coordinated a broader shutdown. The network ultimately remained offline for roughly five weeks, demonstrating meaningful collective intervention capacity without proving that individual transactions can currently be censored.
That distinction aligns closely with the Financial Action Task Force’s 2026 DeFi framework. FATF says smart contracts themselves are not subject to its standards, but identifiable people who maintain control or “sufficient influence” over a DeFi arrangement may fall within the regulatory perimeter. Factors can include the ability to change protocol parameters, profit from the arrangement or otherwise influence how financial services are provided. FATF guidance therefore directs authorities toward functional control rather than simply accepting a project’s decentralized label.
Recent incidents illustrate how differently protocols can design that control layer. NEAR Intents said its SHIELD system rejected more than $50 million in attempted Bitget-linked routes, while THORChain takes a permissionless approach to individual swaps. Separately, Bitcoin from the Coldcard exploit has moved through THORChain and CoinJoin. Those examples establish differing compliance architectures, not that one model automatically creates criminal liability.
Existing Cases Do Not Automatically Decide THORChain’s Exposure
U.S. precedents also require narrower treatment than the draft suggests. In Risley v. Universal Navigation, plaintiffs sought to hold Uniswap-related defendants responsible for scam-token transactions executed through the protocol. The Second Circuit largely upheld dismissal of the federal securities claims, so the decision does not establish a general doctrine that developers become liable whenever decentralized software facilitates unlawful activity.
Criminal cases involving Tornado Cash and Samourai Wallet provide a different framework because prosecutors focused on identifiable operators, fee-generating services, knowledge and conduct. Tornado Cash co-founder Roman Storm was convicted of conspiring to operate an unlicensed money transmitting business, while Samourai’s founders pleaded guilty after admitting they knowingly transmitted criminal proceeds. Those cases show that decentralization or non-custodial design is not necessarily dispositive, but their facts cannot automatically be transferred to THORChain.
Civil litigation is likewise becoming more relevant as courts confront responsibility across decentralized systems. The $292 million KelpDAO-LayerZero dispute asks how liability should be divided when compromised infrastructure interacts with application-level security choices, while separate proceedings over $71 million in frozen ETH show how traditional courts can directly affect on-chain recovery processes. Neither establishes a general legal duty for permissionless protocols to freeze stolen assets.
The next meaningful milestone would therefore be a formal inquiry, enforcement action or court case examining THORChain’s actual governance and operator structure. Until authorities test those facts against money-transmission, AML or sanctions law, the Bitget dispute represents a live legal-risk question rather than evidence that THORChain or its operators have committed an offense. What the May halt does establish is narrower but significant: THORChain possesses collective emergency controls, leaving regulators to determine whether those controls amount to the type of “sufficient influence” contemplated by existing financial-crime frameworks.
