GoPlus Security has raised concerns over the decentralization claims of THORChain, arguing that validator-controlled vaults and emergency protocols provide node operators with capabilities that are not available in Bitcoin and Ethereum.
Summary
- GoPlus claims that THORChain validators have the ability to halt signing, which complicates comparisons with the decentralization models of Bitcoin and Ethereum.
- THORChain documentation states that in the event of a threat to funds, emergency pauses, chain-specific signing halts, and Mimir votes can be enacted.
- The FBI linked the 2025 Bybit hack to North Korea and advised services to block related transactions.
- Following a breach in May that led to a loss of around $10.7 million from a vault, THORChain suspended its network.
- GoPlus alleges that funds tied to Bitget have moved through THORChain, although public confirmation of North Korean involvement remains unconfirmed.
On September 27, GoPlus Security remarked that THORChain should avoid directly aligning its cross-chain framework with decentralized Layer 1 networks in its justification for the inability to block stolen funds. The firm pointed to THORChain’s threshold-signature vaults, active validator set, and emergency governance mechanisms.
This critique arises amid heightened scrutiny concerning stolen funds funneled through THORChain in the wake of the Bitget breach. GoPlus contends that roughly 101.5 BTC linked to the incident had already cycled through the protocol, alongside an additional 27.63 million XRP directed toward Bitcoin.
Bitget has not verified that the September attack was conducted by North Korean individuals. The exchange noted that initial investigations detected similarities in IP and VPN usage with past activities associated with North Korea, but attribution remains uncertain, according to reports by crypto.news following the Bitget breach.
THORChain validators can pause signing in emergencies
GoPlus based part of its argument on the controls detailed in THORChain’s own documentation. It indicates that a node operator can issue a pause command in response to a critical threat to funds. Each pause lasts for 720 blocks, approximately one hour, and additional nodes can extend the suspension.
Node operators can subsequently cast votes on more specific actions through Mimir, the on-chain parameter management system of the protocol. Emergency actions outlined in THORChain’s documentation encompass trading halts, chain-specific suspensions, and signing controls.
GoPlus argued that these controls set THORChain apart from Bitcoin or Ethereum’s foundational consensus mechanisms. THORChain utilizes threshold signatures to oversee outbound transactions from shared vaults, making the signing process for cross-chain swaps a collaborative effort among participating nodes.
THORChain describes this mechanism as a security design aimed at distributing control among independent node operators rather than consolidating vault keys within a singular entity.
The protocol’s report on its May exploit states that operational Mimir parameters can be initiated following three node votes. A total of four votes can overturn that decision, and five votes can restore it. Economic parameters require a supermajority of two-thirds.
GoPlus referenced these features to contend that THORChain has mechanisms available to stop specific flows when operators perceive that funds are at risk.
May exploit highlighted THORChain’s capacity to coordinate a halt
THORChain enacted these controls during its own security incident on May 15.
A malicious validator took advantage of vulnerabilities in the protocol’s GG20 Threshold Signature Scheme and reconstructed the private key for one Asgard vault, resulting in a loss of around $10.7 million before the network was fully stopped.
Automatic solvency monitoring initially signaled unusual vault balances, prompting halted signing and trading across multiple chains. Node operators then coordinated on Discord and utilized manual pauses and Mimir votes to cease trading, signing, chain monitoring, and validator rotation.
According to THORChain’s official exploit report, 18 to 20 nodes accumulated pause commands during the response. A complete halt was achieved within about two hours after community members raised the alarm.
The network stayed offline for roughly five weeks, with trading resuming on June 23 after instituting patched signing code, conducting vault checks, and implementing governance-approved recovery measures.
As reported by crypto.news upon the resumption of trading, THORChain effectively restored swaps, signing, churning, and liquidity operations after completing its restart process.
GoPlus characterized this intervention as evidence of the operational tools available to THORChain operators for discontinuing network activity when security issues escalate to an emergency level.
Bybit laundering controversy is key to the argument
The debate surrounding illicit transactions traces back to the February 2025 Bybit hack. The FBI officially attributed the theft of about $1.5 billion in virtual assets from Bybit to North Korea, identifying it as part of the TraderTraitor campaign in its public notice.
The agency actively urged exchanges, bridges, RPC operators, DeFi services, and blockchain organizations to obstruct transactions linked to addresses associated with the stolen assets.
A substantial portion of the stolen Ethereum was later converted into Bitcoin through cross-chain services. Bybit CEO Ben Zhou stated that roughly 72% of the nearly $900 million in converted assets passed through THORChain.
Crypto.news reported in March 2025 that the attackers transformed the majority of the stolen 499,000 ETH within ten days, with THORChain facilitating a significant number of those swaps.
During that laundering period, THORChain recorded $2.91 billion in trading volume and approximately $3 million in fee revenue over five days, as indicated by on-chain data cited by crypto.news.
GoPlus’s recent report utilizes a revised estimate of about $5.9 billion in volume and $5.5 million in fees. These figures reflect the security firm’s calculations and have not been confirmed by THORChain’s financial reports.
Prior THORChain vote to block flows was revoked
The Bybit situation led to an internal conflict among THORChain contributors and validators. In February 2025, three validators voted to halt Ethereum trading as stolen Bybit funds were processed through the protocol. Developer Oleg Petrov later indicated that the decision was reversed in just minutes.
Core contributor Pluto subsequently expressed intentions to withdraw his contributions to THORChain, while validator TCB mentioned he might also exit unless the network devised a method for blocking flows associated with North Korea.
THORChain’s founder, John-Paul Thorbjornsen, supported ongoing trading and opposed the idea of allowing a non-authoritative third party to dynamically update protocol-level deny lists.
Thorbjornsen stated he would advocate for nodes to implement static deny lists based on official OFAC or FBI data if individual operators felt comfortable doing so.
GoPlus now posits that official governmental attribution offers a stronger foundation for intervention than dynamic lists maintained by private security entities.
The FBI’s 2025 notice regarding Bybit specifically requested that private-sector virtual asset services obstruct transactions tied to the addresses outlined in the TraderTraitor campaign.
Bitget flows reignite the decentralization discussion
GoPlus has revisited earlier arguments following the September Bitget breach. The firm claims that nearly 101.5 BTC, valued at about $8.5 million, has already transitioned through THORChain from Bitget-related flows. Additionally, another 27.63 million XRP, worth almost $43 million, has been directed towards Bitcoin swaps.
These figures stem from GoPlus’s tracing efforts and should be viewed as the security firm’s analysis rather than officially acknowledged numbers from Bitget or THORChain.
Bitget has escalated its confirmed estimate of assets transferred to addresses controlled by attackers to around $387.5 million. The exchange is now offering recovery bounties and plans to gradually restore withdrawals starting September 28. Crypto.news reported on the updated loss figures and bounty program on September 26.
GoPlus stated that THORChain could utilize its existing emergency protocols concerning funds connected to addresses officially identified by entities like the FBI or OFAC.
THORChain’s documented emergency protocols outline a critical event as one where funds in pools or vaults are in danger of an attack or another threat to protocol security. The guidelines instruct node operators to initiate pauses and vote on specific emergency actions in such scenarios.
The central issue raised by GoPlus is whether the same framework should be exercised for assets stolen externally that are traversing THORChain. While THORChain’s published guidelines detail technical security emergencies, they do not claim that every case of third-party theft mandates a protocol suspension.
