$387.5 million drained from Bitget moved through THORChain's cross-chain swap protocol faster than its validators could coordinate a response, co-founder Chad Barraford said on Laura Shin's Unchained podcast this week.

Reaching the two-thirds consensus needed to intervene takes an average of three days and can stretch to two weeks, far slower than the minutes an attacker needs to move funds to a fresh address.

What mechanisms does THORChain actually have?

Appearing alongside onchain investigator Taylor Monahan, Barraford stressed that THORChain currently offers no mechanism to immediately censor individual transactions or wallets. Building one would still leave validators racing against the same coordination gap.

The protocol does expose several intervention tools:

• A halt function for Ethereum or Bitcoin trading
• MakePause, which lets a single node halt chains for 720 blocks, roughly one hour
• A vault migration process that reallocates funds, requiring two-thirds consensus and one to two weeks to complete

"You can't have the fast enough response because the protocol is decentralized," Barraford said.

Shin argued that the Ethereum halt function could have returned swaps tied to stolen Bitget funds to their original sender rather than letting them continue through the protocol. Barraford countered that invoking these tools during an active laundering run penalizes legitimate users while validators negotiate a durable response.

Why didn't validators act on Bybit either?

The Bitget dispute echoes a failed vote that followed the earlier Bybit hack. Barraford said several validators attempted to pause Ethereum trading as stolen funds moved through THORChain, but most operators rejected the motion.

"A few did it, but the vast majority didn't want to do that," Barraford said.

He estimated roughly 20 validators may have left around that disagreement, though he described the figure as approximate and noted the network has since added operators.

Barraford contrasted that slow reaction with the consensus speed when THORChain itself is under direct threat. "When there's a bug or an exploit on ThorChain, there is a wide consensus immediately amongst all validators that we need to pause trading," he said.

Monahan cited the ThorFi incident, in which an admin key paused lending before validators formalized a response, and the 2016 DAO hack era, when ShapeShift repeatedly blocked addresses attempting to convert stolen ether into bitcoin. Barraford replied that ShapeShift's centralized posture at the time allowed near-instant responses a validator-driven protocol cannot match.

Could THORChain adopt something like NEAR's Shield?

Shin pointed to NEAR Intents' Shield risk layer as a faster-acting alternative. She said the system refuses quotes and halts swaps mid-execution, blocking an attempted $50 million laundering run, freezing roughly $500,000 during one swap, and planning to return $340,000 of it.

Asked whether THORChain could deploy similar safeguards, Barraford framed the decision as a validator choice, not a technical impossibility. "Maybe. If the nodes want to deploy something like that, it's up for validators to determine," he said. "If the nodes wanted to do that, they could. My guess is they wouldn't, but I don't speak for them."

What would actually block laundering through THORChain?

Pushed by Shin to specify the threshold, Barraford acknowledged that a coordinated validator majority could in theory censor illicit transactions.

"Then laundering would be blocked," he said. "If you get a two third majority agreeing that we should censor transactions, then sure, that would be the way of the community."

He closed the discussion with an even broader concession about governance. "Yes, if you get consensus behind any change, you could change anything," Barraford said.

For Bitget, and for the next victim, the unresolved question is whether THORChain's validator set will reach two-thirds agreement on faster safeguards before another nine-figure haul crosses the protocol.