THORChain has come under renewed scrutiny after Bitget lost $387.5 million in a hack last week and its CEO, Gracy Chen, called on the crosschain swap protocol to deny service to addresses tied to the theft. Investigators were able to flag and trace the recipient wallets quickly, but THORChain did not — or could not — block them, reopening a long-running argument over what decentralized protocols are expected to do when stolen crypto moves through their rails.
Cointelegraph Magazine discussed the issue with Yuriy Brisov, a crypto lawyer at D&A Partners, in an edited interview centered on whether developers could face legal exposure, including claims tied to money laundering, if a DeFi protocol does not stop suspicious flows.
Decentralization can be a defense, but only if it is real
Brisov said the legal answer depends on the protocol’s actual degree of decentralization. If a project can block selected addresses, that may help prevent malicious activity, but it also shows that its nodes or operators are not fully beyond discretionary control.
That matters because, in his view, the strongest defense available to many DeFi protocols is the argument that they are truly decentralized and cannot intervene. He pointed to the Uniswap case, where investors sued after buying 38 rug-pull and scam tokens, only for a judge to dismiss the case in March. For Brisov, that outcome underscored the value of the "we are decentralized and there is nothing we can do" line of defense.
Once a protocol demonstrates that it can block, control, or otherwise interfere, even in good faith, it opens the door to a wider set of claims. If there is control in one obvious fraud case, critics can ask why that same control is not applied to due diligence, KYC, AML, and other compliance safeguards.
NEAR Intents took the opposite route
This is not the first time THORChain has landed in the middle of a stolen-funds dispute. Around $1.2 billion from the $1.46 billion Bybit hack was swapped through THORChain, and the protocol’s admin key had been retired just 11 days earlier.
NEAR Intents handled the Bitget-related addresses very differently. Its automated SHIELD program blocked $50 million tied to the hack from being swapped on the platform, and it also declined the 5% bounty Bitget had offered. That decision earned thanks from Bitget, but it also drew criticism from decentralization hard-liners who argued Intents was not permissionless enough.
Brisov said that once a project shows it has control over assets or user flows, it may expose itself to potential claims tied not only to hacks, but also to pump-and-dump schemes, volatility, and other investor losses. The argument from injured parties becomes straightforward: if the protocol can intervene in one case, why not in another? Why not review every token issuer? Why not require KYC forms like a centralized exchange?
Whether THORChain can actually block addresses is central
THORChain has argued that the protocol halt in May was initially triggered by an automated system and that it does not have the ability to block specific addresses. Brisov said that, if true, this might serve as a defense, though he cautioned that the point has not yet been tested in court or another formal legal challenge.
He added that any amount of control tends to weaken a DeFi project’s position against future claimants.
The interview then turned to a harder question: even if the protocol cannot manually press a button today, what if it could upgrade its software to impose wallet screening? Could failure to do that expose a project to claims of negligence or recklessness? Brisov said the answer depends on how the system is built.
He drew a distinction between automated and manual intervention. If an oracle can detect a North Korean IP address and block it automatically, with no person making a case-by-case decision, he said that is acceptable. If a team monitors activity, decides that a wallet is linked to illicit conduct, and manually blocks it, the legal picture changes. Even if the action benefits the community, the project looks less than fully decentralized from a legal standpoint.
Under that reading, the protocol may lose part of the protection associated with frameworks such as MiCA, or the general regulatory understanding Brisov said the SEC and CFTC apply when a network is fully decentralized and its operators are not responsible for participant conduct across the ecosystem.
Automated screening is not the same as human control
NEAR’s SHIELD system was a key example in the discussion. The technology identifies addresses associated with known hacks on public blockchains and blocks them from accessing Intents automatically. Brisov said that setup is more likely to be seen as compatible with decentralization because it embeds protective measures into the protocol itself rather than relying on a compliance team or manual supervision.
He described that model as a smart solution and said it is the sort of approach his firm recommends to DeFi companies.
Admin key retirement and validator count still do not settle the issue entirely
In February 2025, THORChain retired the admin key that would have enabled unilateral changes of this kind. The interview also noted that the network has a hundred validators. Asked whether those facts make THORChain sufficiently decentralized, Brisov said that is more likely than not the case, though he stopped short of calling it certain. His own answer leaned yes.
Why Brisov does not see a straightforward money-laundering case
One of the most sensitive questions is whether THORChain could be exposed to money-laundering liability for processing stolen funds. The interview stressed that THORChain is not a mixer. Stolen Bitget assets may be swapped through the protocol, but when they emerge on the other side, the trail still remains transparently linked to the Bitget hackers.
For that reason, Brisov said he does not see how THORChain could be liable for money laundering. He referred to Tornado Cash and argued that even there, immutable smart contracts were treated differently because they are not property in the legal sense used in money-laundering analysis. In his explanation, US law first asks whether the thing in question is property. Money laundering involves moving illicit proceeds through legal channels to make them appear legitimate. Smart contracts, he said, are not property that someone owns or controls.
That is also why, in his account, Tornado Cash prevailed in court against OFAC sanctions arguments: the defense showed that no one controlled the smart contracts themselves.
The Bybit episode does not mean THORChain is in the clear
The interview closed with a question about timing. The Bybit hack happened 18 months ago, so does the absence of action to date suggest that no legal case is coming? Brisov said no. He said legal action could still happen in the future and that, after the Bybit episode, THORChain had already opened itself to potential claims.
The interview leaves the issue unresolved, but the dividing line is clear. A protocol that can show no human control may preserve its decentralization defense. A protocol that demonstrates discretionary intervention, even for a legitimate purpose, may gain short-term approval while making its legal position harder to defend later.