VeChain Refutes Bybit Report, Says 2019 Blocklist Was a One-Time Community Decision

VeChain has pushed back against a recent report from Bybit’s Lazarus Security Lab that alleged the project’s blockchain contains a concealed mechanism capable of freezing user funds. In a statement released Thursday, the team dismissed the claims as inaccurate and damaging to its reputation.

VeChain addressed the issue directly on X, clarifying that the only event resembling a freeze occurred in December 2019, when a private key leak compromised a single wallet. Following the breach, the community approved a one-off blocklist designed solely to prevent the attacker from offloading the stolen tokens. Validators upgraded their software to reject any transactions coming from the compromised addresses, ensuring the assets couldn’t be moved. According to the team, the action was transparent, voted on, and executed through governance—not via any hidden protocol-level switch.

The project also highlighted the distinction between blocking transactions at the validator level and hardcoded freezing logic. VeChain criticized the report for blending the two concepts, urging the authors to conduct a deeper technical review to avoid misleading conclusions.

Independent audits by firms such as NCC Group, Coinspect, and Hacken have confirmed that VeChainThor does not include any built-in code that would allow developers or validators to seize, freeze, or control user funds. Validators can reject certain transactions when a community-approved process exists, but the blockchain’s consensus design prevents unilateral intervention.

Bybit’s Lazarus Security Lab report, titled “Blockchain Freezing Exposed,” claimed that 16 major blockchains possess mechanisms that enable developers or validators to freeze or restrict user funds. VeChain was listed alongside BNB Chain, Sui, Aptos, and XDC Network. The study reviewed 166 networks using a mix of AI code analysis and manual inspection, categorizing freezing tools into hardcoded freezes, configuration-based limitations, and contract-level controls.

The report referenced several past incidents, including Sui blocking $162 million in funds after the Cetus exploit and BNB Chain implementing blacklists during a $570 million bridge hack. While the researchers acknowledged that such measures can reduce further damage after security breaches, they also argued that these tools raise questions about decentralization and censorship.