THORChain’s Decentralization Challenged by North Korean Fund Flows
GoPlus Security has questioned the decentralization assertions of THORChain, stating that validator-controlled vaults and emergency protocols grant node operators capabilities that are not present in Bitcoin and Ethereum.
Summary
- GoPlus asserts that THORChain validators can stop signing, complicating comparisons with the decentralization structures of Bitcoin and Ethereum.
- According to THORChain documentation, emergency pauses, chain-specific signing halts, and Mimir votes can be enacted when funds are at risk.
- The FBI linked the 2025 Bybit theft to North Korea and advised services to block related transactions.
- THORChain suspended its network following a May breach that resulted in the loss of approximately $10.7 million from a vault.
- GoPlus claims that funds associated with Bitget have traversed THORChain, although public confirmation of North Korean involvement is still pending.
On September 27, GoPlus Security stated that THORChain should refrain from directly comparing its cross-chain design to decentralized Layer 1 networks when justifying the inability to block stolen funds. The firm highlighted THORChain’s threshold-signature vaults, active validator set, and emergency governance capabilities.
This criticism comes in light of increased scrutiny regarding stolen funds routed through THORChain following the Bitget breach. GoPlus claims that around 101.5 BTC linked to the incident had already passed through the protocol, with an additional 27.63 million XRP being directed toward Bitcoin.
Bitget has not publicly confirmed that its September attack was carried out by North Korean actors. The exchange indicated that investigators detected initial IP and VPN similarities with past activities linked to North Korea, but attribution remains unverified, as reported by crypto.news following the Bitget breach.
THORChain validators can suspend signing in emergencies
GoPlus based part of its argument on the controls laid out in THORChain’s own documentation. According to that documentation, a node operator can issue a pause command when funds are under critical threat. Each pause lasts for 720 blocks, or about one hour, while additional nodes can prolong the suspension.
Node operators can subsequently vote on more specific actions through Mimir, the on-chain parameter system of the protocol. THORChain documentation includes trading halts, chain-specific suspensions, and signing controls as part of its emergency actions.
GoPlus contended that these controls differentiate THORChain from Bitcoin or Ethereum’s base-layer consensus. THORChain employs threshold signatures to manage outbound transactions from shared vaults, meaning that the signing process for cross-chain swaps is collectively managed by participating nodes.
THORChain describes this mechanism as a security design that aims to distribute control among independent node operators instead of consolidating vault keys within a single entity.
The protocol’s report on its May exploit mentions that operational Mimir parameters can be activated following three node votes. A total of four votes can overturn that decision, while five votes can reinstate it. Economic parameters necessitate a supermajority of two-thirds.
GoPlus referred to these features to argue that THORChain possesses mechanisms capable of halting specific flows when operators perceive that funds are at risk.
May exploit demonstrated THORChain’s ability to coordinate a halt
THORChain activated these controls during its own security incident on May 15.
A malicious validator exploited vulnerabilities in the protocol’s GG20 Threshold Signature Scheme and reconstructed the private key for one Asgard vault, resulting in a loss of approximately $10.7 million before the network came to a complete stop.
Automatic solvency monitoring initially detected abnormal vault balances, leading to halted signing and trading on several chains. Node operators then coordinated via Discord and utilized manual pauses and Mimir votes to cease trading, signing, chain monitoring, and validator churning.
According to THORChain’s official exploit report, around 18 to 20 nodes stacked pause commands during the response. A fully controlled halt was accomplished within roughly two hours after community members raised the alarm.
The network remained offline for approximately five weeks, with trading resuming on June 23 after the implementation of patched signing code, vault checks, and governance-approved recovery procedures.
As reported by crypto.news when trading resumed, THORChain successfully restored swaps, signing, churning, and liquidity operations after completing its restart process.
GoPlus referred to this intervention as indicative of the operational tools that THORChain operators have for halting network activity when security concerns escalate to an emergency level.
Bybit laundering dispute is central to the argument
The controversy surrounding illicit transactions traces back to the February 2025 Bybit hack. The FBI officially attributed the theft of approximately $1.5 billion in virtual assets from Bybit to North Korea, identifying it as part of the TraderTraitor campaign in its public notice.
The agency specifically urged exchanges, bridges, RPC operators, DeFi services, and blockchain companies to block transactions related to addresses associated with the stolen assets.
A significant portion of the stolen Ethereum was subsequently converted into Bitcoin through cross-chain services. Bybit CEO Ben Zhou stated that approximately 72% of the nearly $900 million in converted assets had circulated through THORChain.
Crypto.news reported in March 2025 that the attackers transformed the majority of the stolen 499,000 ETH within ten days, with THORChain facilitating a substantial amount of those swaps.
During that laundering period, THORChain recorded $2.91 billion in trading volume and about $3 million in fee revenue over a span of five days, as indicated by on-chain data cited by crypto.news.
GoPlus’s recent report utilizes a later estimate of around $5.9 billion in volume and $5.5 million in fees. These figures represent the security firm’s calculations and have not been verified by THORChain’s financial disclosures.
Earlier THORChain vote to block flows was rescinded
The Bybit situation led to an internal conflict among THORChain contributors and validators. In February 2025, three validators voted to suspend Ethereum trading as stolen Bybit funds traversed the protocol. Developer Oleg Petrov later mentioned that the action was reversed within minutes.
Core contributor Pluto subsequently indicated he would cease contributions to THORChain, while validator TCB mentioned he might also leave unless the network developed a mechanism to block flows linked to North Korea.
THORChain’s founder, John-Paul Thorbjornsen, supported ongoing trading and opposed allowing a non-authoritative third party to dynamically update protocol-level deny lists.
Thorbjornsen stated he would back nodes implementing static deny lists based on official OFAC or FBI data if individual operators felt comfortable doing so.
GoPlus now contends that official government attribution provides a more solid basis for intervention than dynamic lists maintained by private security firms.
The FBI’s 2025 notice regarding Bybit explicitly requested that private-sector virtual asset services block transactions tied to the addresses mentioned in the TraderTraitor campaign.
Bitget flows reignite the decentralization debate
GoPlus has revived earlier arguments following the September Bitget breach. The firm claims that approximately 101.5 BTC valued at around $8.5 million has already transitioned through THORChain from Bitget-related flows. Additionally, another 27.63 million XRP, worth nearly $43 million, has been directed towards Bitcoin swaps.
These figures are derived from GoPlus’s tracing and should be regarded as the security firm’s analysis rather than officially confirmed numbers from Bitget or THORChain.
Bitget has escalated its confirmed estimate of assets transferred to attacker-controlled addresses to approximately $387.5 million. The exchange has started offering recovery bounties and plans to restore withdrawals gradually from September 28. Crypto.news reported on the revised loss and bounty program on September 26.
GoPlus stated that THORChain could apply its existing emergency protocols for funds linked to addresses officially identified by organizations such as the FBI or OFAC.
THORChain’s documented emergency protocols define a critical event as one where funds in pools or vaults are facing an attack or another threat to protocol security. The guidelines instruct node operators to initiate pauses and vote on specific emergency actions in such scenarios.
The contention raised by GoPlus revolves around whether the same framework should be implemented for assets stolen externally that are moving through THORChain. While THORChain’s published guidelines characterize technical security emergencies, they do not assert that every incident of third-party theft necessitates a protocol suspension.