2019 Blocklist Was Not a Secret Kill Switch

VeChain clarifies that the 2019 blocklist action was a one-time, community-approved response.

VeChain has issued a firm clarification denying recent allegations made in a report published by Bybit’s Lazarus Security Lab, which claimed that the blockchain includes a hidden feature allowing funds to be frozen.

In a statement released on Thursday, VeChain categorically rejected the claims as “factually incorrect and reputationally damaging.”

VeChain Slams Bybit’s Research Lab

Addressing the specific allegations in its recent post on X, the team explained that the only incident resembling such action occurred in December 2019, when a private key theft compromised a single VeChain wallet. Following the breach, the VeChain community voted to implement a one-time, community-approved blocklist to prevent the liquidation of the stolen assets.

Validators upgraded their node software to reject transactions originating from the thief’s wallets and ensured the stolen funds could not be moved or reallocated. The measure, VeChain clarified, was a transparent, governance-driven response to a major security event and not a unilateral fund freeze embedded in the protocol’s source code.

The company further explained that the technical distinction between “blocking” and “freezing” while criticizing the Bybit report for conflating validator-level inclusion policies with hardcoded freezing capabilities.

“We encourage the author of the report to conduct a deeper technical review to understand the implications of mixing up these two mechanisms in a public forum.”

VeChain also pointed out that independent audits, including those by NCC Group, Coinspect, and Hacken, have confirmed that VeChainThor’s software enables validators, through community-approved governance, to reject certain transactions, but not to seize or freeze assets. The blockchain’s consensus-level checks are designed to support decentralized decision-making rather than centralized control, VeChain added.

Bybit’s Research

Bybit’s Lazarus Security Lab report, titled “Blockchain Freezing Exposed: Examine the Impact of Fund Freezing Ability in Blockchain,” claimed that 16 major blockchain networks possess features that allow developers or validators to freeze or restrict user funds. According to the report, VeChain was among several networks, including Binance-backed BNB Chain, Sui, Aptos, and XinFin’s XDC Network, listed as having hardcoded freezing mechanisms directly embedded in their source code.

You may also like:

The study, which examined 166 blockchain networks using AI-assisted code analysis and manual verification, identified three primary categories of freezing mechanisms: hardcoded freezing, configuration-based freezing, and on-chain contract freezing.

The report cited multiple historical examples of fund-freezing events, including Sui freezing $162 million in stolen assets following the Cetus hack, and BNB Chain deploying hardcoded blacklists to contain a $570 million bridge exploit. Researchers concluded that while such interventions can help mitigate damage from security breaches, they also raise concerns about centralization and censorship. It said that the existence of fund-freezing functions, even when implemented for security purposes, challenges the notion of full decentralization.