Key takeaways
- Reporting raises the question of whether THORChain could face prosecution over stolen funds from the Bitget breach passing through it — a question with no settled answer in any jurisdiction.
- The difficulty is structural: money laundering rules were written for intermediaries who make decisions about transactions. A protocol that cannot refuse a transaction has no decision to prosecute.
- There is direct precedent in both directions — developers of privacy tooling have faced charges, and sanctions applied to immutable smart contracts have been successfully challenged in court.
- The practical exposure sits with identifiable people who built or promoted the software, not with the software. That distinction determines who is at risk and it is not the one most people assume.
Reporting this week asks whether THORChain could face prosecution over stolen funds from the Bitget breach moving through it. We have covered that incident three times now — the withdrawal suspension, the freezing attempt, and the recovery assessment. This is the part with genuinely unresolved law behind it.
The question is not whether laundering stolen money is illegal. It plainly is. The question is who commits that offence when the mechanism used has no operator who could have refused.
Why existing rules do not fit
Anti-money-laundering law is built around intermediaries. A bank, an exchange or a payment processor stands between two parties, sees the transaction, and decides whether to process it. The obligations follow from that decision point: know your customer, monitor for suspicious patterns, file reports, refuse or freeze where required.
Every one of those duties presumes somebody capable of saying no.
A swap protocol of this kind has no such position. The contracts execute for whoever calls them. There is no account, no onboarding, and frequently no party with the technical ability to block an address even if served an order requiring it. The software does not evaluate its counterparty because it cannot.
So the legal machinery reaches for a decision-maker and does not find one. That is the whole difficulty, and it is not a loophole somebody engineered — it follows from what the software is.
Which leads to an uncomfortable question
If there is no operator, prosecutors look for the nearest identifiable people. Broadly three candidates, and they are treated very differently.
The developers. Those who wrote and deployed the code. The argument against liability is that writing software is not operating a service, and code is not conduct. The argument for is that building something whose predictable use includes moving criminal proceeds, and continuing to maintain and promote it, is a choice rather than an accident.
The front-end operators. Whoever runs the website most users actually interact with. This is a much more conventional target, because a website operator makes ongoing decisions — what to display, whom to serve, whether to screen addresses. Several front ends across this industry have quietly added screening for exactly this reason.
The validators or liquidity providers. Those who run infrastructure or supply capital and earn fees from throughput. The theory here is that earning revenue from a flow creates some responsibility for its composition. This is the least tested of the three.
The precedents point in both directions
Anyone telling you this is settled is arguing rather than describing. The record genuinely cuts both ways.
Toward liability: developers of privacy-focused tooling have faced criminal charges in multiple jurisdictions, on theories that building and operating the means of concealment is itself participation. Those cases established that "I only wrote code" is not automatically a defence.
Against liability: when US sanctions were applied to immutable smart contracts, that action was challenged and the challenge succeeded on the basis that an autonomous contract with no controlling party is not a "person" or "property" the statute reaches. That decision matters, because it says the law's categories genuinely do not extend to software nobody controls.
So the current position is roughly: the code itself is difficult to reach, and the identifiable humans around it are not.
What this means if you build
Not legal advice, and speak to counsel in your jurisdiction. But the structural reading is clear enough to be useful.
Your exposure tracks how much control you retain, not how decentralised you describe yourself as being. Admin keys, upgrade rights, a fee that routes to you, a front end you operate, a treasury you direct — each of those is a decision point, and decision points are what liability attaches to.
Which produces a genuine tension worth naming. The features that let a team fix bugs, respond to incidents and make users whole after an exploit — the very things we praised a team for doing earlier this week — are the same features that establish control. You cannot claim the ability to intervene when it is reputationally useful and disclaim it when it is legally inconvenient.
And if you use these protocols
Two practical points.
First, receiving funds that passed through a mixer or a protocol carrying tainted flows can cause you problems at the point you touch a regulated venue, regardless of your own conduct. Exchanges screen deposits against address risk scores, and a deposit flagged as related to a known incident can be frozen while questions are asked. That is a real operational risk rather than a theoretical one.
Second, a protocol facing regulatory pressure can lose front-end access, exchange integrations and liquidity quickly, even where no charges are brought. As we noted about how projects die, regulatory closure does not require a conviction — it requires the economics to stop working.
Elsewhere: the UK window opens
More immediately actionable for UK readers: the FCA has opened its crypto authorisation application window, with a February deadline ahead of the 2027 regime.
That timeline is the thing to note. Firms that intend to serve UK customers need applications in within months, and authorisation processes of this kind routinely take longer than firms expect. Businesses that miss the window face operating without permission in a regime that will have one.
This is the rule-making stage we keep pointing at — the part that decides what actually happens, arriving on a calendar almost nobody is watching.
Separately, the SEC has changed its guidance on token buybacks as spending in that category reached $638 million. We covered buybacks in detail; the guidance shift is worth reading closely if you hold anything with a buyback programme, because it may change how those programmes are structured rather than whether they continue.
The market
Bitcoin is around $83,600, roughly flat on the day and down about 1% over the week. Ether is near $2,677. US PCE inflation reportedly cooled to 3.3%, which is the macro input worth watching given how much of this year's crypto movement has tracked rate expectations rather than anything crypto-specific.
What to take from this
Anti-money-laundering law assumes an intermediary who can refuse a transaction. Software that cannot refuse has no decision to prosecute, so enforcement reaches for the people around it instead.
The determining factor is control — who holds keys, runs the interface, takes the fees. Which means "decentralised" is a description of an architecture, and whether it is accurate is a question about that architecture rather than about the marketing.
Frequently asked questions
Can a smart contract be prosecuted?
Not meaningfully. Prosecution requires a person or entity, and when US sanctions were applied to immutable smart contracts, that was successfully challenged on the basis that autonomous code with no controlling party is not a person or property the statute reaches. Enforcement therefore targets identifiable people connected to the software rather than the software itself.
So are developers safe because they just wrote code?
No, and this is the point where confident claims should be distrusted. Developers of privacy-focused tooling have faced criminal charges in multiple jurisdictions on theories that building and operating the means of concealment is participation. Those cases established that writing code is not an automatic defence. The outcomes have varied, which is precisely why the area is unsettled.
What determines whether someone is exposed?
Control, in practice. Admin or upgrade keys, a fee stream that routes to you, a front end you operate, a treasury you direct — each is a decision point, and liability attaches to decision points. Describing a project as decentralised does not affect this; the question is whether the architecture actually removes those control points.
Could I get in trouble for receiving funds that passed through such a protocol?
You can face practical problems even with entirely lawful conduct. Regulated exchanges screen deposits against address risk data, and a deposit connected to a known incident can be frozen while questions are asked. That is an operational risk worth knowing about — it is about proving provenance rather than about wrongdoing.
Does a protocol need to be convicted to be damaged by this?
No. Regulatory pressure alone can remove front-end access, exchange integrations and liquidity well before any legal conclusion. A protocol can be technically sound and commercially finished, which is one of the recurring ways projects end.
Sources
Every figure and quote above traces to one of these. Checked on publication day.
- cryptoslate.com — Could THORChain face prosecution over stolen Bitget funds?
- theblock.co — FCA opens crypto authorization window ahead of 2027 UK regime
- cryptoslate.com — SEC changes token buyback guidance as spending hits $638M
Deepmoni Das, Editor
I read the primary filings, exchange notices and post-mortems behind each story and write up what they actually say — with every source linked so you can check me. I am not a trader and I do not hold positions in anything covered here. Research and drafting are AI-assisted; the sourcing, the edits and the mistakes are mine.
Not financial advice. Crypto assets are volatile and unregulated in many jurisdictions. In India, gains are taxed at 30% with 1% TDS on transfers. Do your own research and never invest money you cannot afford to lose.
Editorial note: Crypto Shakti uses an AI-assisted research and drafting workflow. Every article is grounded in the linked primary sources and live market data captured at publication time.