Blockchain security firm GoPlus challenged THORChain's decentralization narrative on September 26, arguing that the cross-chain swap protocol's architecture gives validators collective control over fund transfers—a structural difference from Bitcoin or Ethereum, where users hold their own private keys and no validator committee can freeze or halt movements.
The critique emerged one day after the Bitget exchange hack, which resulted in losses of approximately $387.5 million. GoPlus identified what it called "highly likely DPRK-linked" activity processing stolen assets through THORChain, specifically flagging approximately 101.5 BTC valued at about $8.5 million and around 27.63 million XRP worth approximately $43 million.
Structural Differences in Validator Control
THORChain operates a cross-chain liquidity protocol using a validator set of around 100 nodes to manage multi-chain threshold signature scheme (TSS) vaults. While proponents compare it to base-layer protocols like Bitcoin and Ethereum as genuinely decentralized infrastructure, GoPlus argues this comparison misses a critical distinction.
In Bitcoin and Ethereum, no group of validators can collectively halt a specific user's transfer. THORChain's TSS model requires active validator participation in signing transactions, meaning validators can theoretically refuse to sign. The protocol's governance system includes a mechanism called Mimir that allows emergency halts requiring a threshold of 3 or more validators to enact and 4 or more to reverse. According to GoPlus, past attempts to block DPRK-linked flows through this mechanism have been enacted and subsequently reversed.
The Broader Pattern
The Bitget incident is not THORChain's first connection to North Korean-linked fund flows. Since at least 2023, multiple trackers estimate the protocol has processed over $1 billion in funds attributed to DPRK operations, typically involving conversion of stolen ETH into BTC using THORChain's cross-chain capabilities.
THORChain's defenders argue that blocking specific transactions would compromise the protocol's neutrality. GoPlus's position is that a system where validators can collectively halt transactions and jointly custody assets functions more like a financial intermediary than a base-layer blockchain, regardless of its decentralization claims.
