\n
![](\"https:\/\/media.crypto.news\/2022\/03\/Thorchain_RUNE.webp\")
<\/p>\n
\n<\/p>\n
GoPlus Security has challenged THORChain\u2019s decentralization claims, arguing that its validator-controlled vaults and emergency mechanisms give node operators powers that differ from Bitcoin and Ethereum.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n GoPlus Security said on Sept. 27 that THORChain should not compare its cross-chain architecture directly with decentralized Layer 1 networks when explaining why stolen funds cannot be blocked. The firm pointed to THORChain\u2019s threshold-signature vaults, active validator set and emergency governance controls.<\/p>\n Its criticism follows renewed scrutiny over stolen funds routed through THORChain after the Bitget breach. GoPlus claims around 101.5 BTC linked to the incident had already exited through the protocol, while another 27.63 million XRP was being routed toward Bitcoin.<\/p>\n Bitget has not publicly confirmed that North Korean actors carried out its September attack. The exchange said investigators had seen preliminary IP and VPN similarities associated with previous North Korean-linked activity, but attribution remained unconfirmed, as crypto.news reported after the Bitget breach<\/a>.<\/p>\n <\/p>\n GoPlus based part of its argument on controls documented by THORChain itself. THORChain\u2019s emergency procedures<\/a> state that a node operator can issue a make pause command when funds face a critical threat. One pause lasts 720 blocks, or roughly one hour, while additional nodes can extend the halt.<\/p>\n Node operators can then vote on more targeted measures through Mimir, the protocol\u2019s on-chain parameter system. THORChain documentation lists trading halts, chain-specific stops and signing controls among the available emergency actions.<\/p>\n GoPlus argued that these controls distinguish THORChain from Bitcoin or Ethereum base-layer consensus. THORChain uses threshold signatures to authorize outbound transactions from shared vaults, meaning participating nodes collectively manage the signing process for cross-chain swaps.<\/p>\n THORChain describes the same mechanism as a security design intended to distribute control among independent node operators rather than place vault keys with one entity.<\/p>\n The protocol\u2019s own May exploit report says operational Mimir parameters can activate after three node votes. Four votes can overturn the decision, while another five can reinstate it. Economic parameters require a two-thirds supermajority.<\/p>\n GoPlus cited those features when arguing that THORChain has mechanisms capable of stopping specific flows when operators believe funds are at risk.<\/p>\n THORChain used those controls during its own security incident on May 15.<\/p>\n A malicious validator exploited weaknesses in the protocol\u2019s GG20 Threshold Signature Scheme and reconstructed the private key for one Asgard vault. Approximately $10.7 million was drained before the network fully stopped.<\/p>\n Automatic solvency monitoring first detected irregular vault balances and halted signing and trading on several chains. Node operators then coordinated through Discord and used manual pauses and Mimir votes to stop trading, signing, chain observation and validator churning.<\/p>\n THORChain\u2019s official exploit report<\/a> says roughly 18 to 20 nodes stacked pause commands during the response. A complete controlled halt was reached within around two hours after community members raised the alarm.<\/p>\n The network remained offline for roughly five weeks. Trading resumed June 23 after patched signing code, vault checks and governance-approved recovery procedures were introduced.<\/p>\n As crypto.news reported when trading <\/a>resumed<\/a>, THORChain restored swaps, signing, churning and liquidity operations after completing its restart process.<\/p>\n GoPlus referred to that intervention as evidence that THORChain operators possess working tools for stopping network activity when security concerns reach an emergency threshold.<\/p>\n The disagreement over illicit transactions dates back to the February 2025 Bybit hack. The FBI formally attributed the theft of approximately $1.5 billion in virtual assets from Bybit to North Korea. Its public notice identified the activity as part of the TraderTraitor campaign.<\/p>\n The agency specifically encouraged exchanges, bridges, RPC operators, DeFi services and blockchain companies to block transactions involving addresses connected with the stolen assets.<\/p>\n Much of the stolen Ethereum was later converted into Bitcoin through cross-chain services. Bybit CEO Ben Zhou said around 72% of roughly $900 million in converted assets had passed through THORChain.<\/p>\n Crypto.news reported in March 2025<\/a> that the attackers converted most of the stolen 499,000 ETH within ten days, with THORChain handling a large share of the swaps.<\/p>\n Early in that laundering period, THORChain recorded $2.91 billion in trading volume and roughly $3 million in fee revenue over five days, according to on-chain data cited by crypto.news.<\/p>\n GoPlus\u2019s new post uses a later estimate of roughly $5.9 billion in volume and $5.5 million in fees. Those figures are the security firm\u2019s calculation and have not been confirmed in THORChain financial disclosures.<\/p>\n The Bybit episode produced an internal dispute among THORChain contributors and validators. In February 2025, three validators voted to halt Ethereum trading as stolen Bybit funds moved through the protocol. Developer Oleg Petrov later said the action was reversed within minutes.<\/p>\n Core contributor Pluto subsequently said he would stop contributing to THORChain. Validator TCB said at the time that he could leave as well unless the network developed a way to stop North Korean-linked flows.<\/p>\n THORChain founder John-Paul Thorbjornsen supported<\/a> continued trading and opposed allowing a non-authority third party to dynamically update protocol-level deny lists.<\/p>\n Thorbjornsen said he would support nodes using static deny lists based on official OFAC or FBI information if individual operators were comfortable doing so.<\/p>\n GoPlus now argues that official government attribution provides a stronger basis for intervention than dynamic lists maintained by private security companies.<\/p>\n The FBI\u2019s 2025 Bybit notice explicitly asked private-sector virtual asset services to block transactions involving or derived from the listed TraderTraitor addresses.<\/p>\n GoPlus brought the earlier arguments back into focus after the September Bitget breach. The firm claims approximately 101.5 BTC worth around $8.5 million has already exited through THORChain from Bitget-linked flows. It said another 27.63 million XRP, valued near $43 million, was moving through swaps toward Bitcoin.<\/p>\n Those numbers come from GoPlus\u2019s tracing and should be treated as the security company\u2019s analysis rather than figures confirmed by Bitget or THORChain.<\/p>\n Bitget has raised its confirmed estimate of assets transferred to attacker-controlled addresses to approximately $387.5 million. The exchange has begun offering recovery bounties and plans to restore withdrawals in stages from Sept. 28. Crypto.news reported the updated loss and bounty program<\/a> on Sept. 26.<\/p>\n GoPlus said THORChain could use its existing emergency framework for funds tied to addresses officially identified by agencies such as the FBI or OFAC.<\/p>\n THORChain\u2019s documented emergency procedures define a critical event as one in which funds in pools or vaults face an attack or another threat to protocol security. The documentation tells node operators to initiate pauses and vote on targeted emergency actions under those conditions.<\/p>\n Whether the same framework should be applied to externally stolen assets moving through THORChain is the point of dispute raised by GoPlus. THORChain\u2019s published procedures describe technical security emergencies but do not state that every third-party theft automatically requires a protocol halt.<\/p>\n <\/p><\/div>\n\n\n
THORChain validators can halt signing during emergencies<\/strong><\/h2>\n
May exploit showed THORChain can coordinate a halt<\/strong><\/h2>\n
Bybit laundering dispute remains central to the argument<\/strong><\/h2>\n
Earlier THORChain vote to block flows was reversed<\/strong><\/h2>\n
Bitget flows renew the decentralization dispute<\/strong><\/h2>\n