A security firm has put a technical argument in front of THORChain that its marketing has mostly avoided: a protocol where validators must actively sign every outbound transfer isn’t structurally the same as one where users hold their own keys, no matter how similar the two look from the outside. That distinction moved from theoretical to urgent this week after funds from the $387.5 million Bitget hack were traced through THORChain’s infrastructure.

Key Takeaways

  • GoPlus Security publicly challenged THORChain’s decentralization claims on September 26, one day after the $387.5 million Bitget exchange hack, according to Crypto Briefing.
  • Roughly 101.5 BTC (about $8.5 million) and around 27.63 million XRP (about $43 million) tied to the hack moved through THORChain, in activity GoPlus called “highly likely DPRK-linked.”
  • THORChain’s threshold signature scheme (TSS) vaults require active validator participation to move funds, a structural difference from Bitcoin and Ethereum, where individual users control their own private keys.
  • THORChain’s Mimir governance mechanism can halt transfers with a threshold of 3 or more validators and reverse a halt with 4 or more; past attempts to block DPRK-linked flows were enacted and then reversed.
  • THORChain declined Bitget’s request to block the flagged addresses, and OKX founder Star Xu joined GoPlus in questioning whether the protocol’s validator-controlled vaults deserve the same “decentralized” label as base-layer chains.

How TSS Vaults Differ From Bitcoin’s Key Model

THORChain is a cross-chain liquidity protocol that lets users swap assets across different blockchains without a centralized intermediary, run by its native token RUNE and a validator set of roughly 100 nodes that jointly manage multi-chain TSS vaults, according to Crypto Briefing. That threshold signature scheme is the crux of GoPlus’s argument: moving funds out of a THORChain vault requires active signing from participating validators, not a single private key held by the asset’s owner. In Bitcoin and Ethereum, no group of validators can collectively decide to halt a specific user’s outbound transfer, because there’s no validator committee sitting between the user and their funds in the first place. GoPlus’s framing, as reported by Crypto Briefing, is blunt: a protocol that can block transactions but chooses not to is a different kind of system than one that structurally cannot.

The Bitget Flows That Triggered the Scrutiny

The critique landed a day after the Bitget hack, which Bitget has since confirmed resulted in roughly $387.5 million moved to attacker-controlled addresses, revised up from an initial estimate of about $351.6 million after newly classified Zcash and TRON transactions were added, according to Baiyi Finance. GoPlus identified approximately 101.5 BTC (about $8.5 million) already transferred out through THORChain, and around 27.63 million XRP (about $43 million) being converted through the protocol, per Gate.com. SlowMist’s on-chain tracking platform, MistTrack, separately tracked the Bitget-linked funds moving into THORChain for swaps and cross-chain transfers, and argued that decentralization “shouldn’t be a blanket excuse” when publicly flagged stolen funds are involved, according to Baiyi Finance.

Mimir’s Pause Powers, and Why They Weren’t Used Here

THORChain’s governance layer, called Mimir, can enact parameter changes and emergency halts, and GoPlus says that mechanism requires 3 or more validators to trigger a halt and 4 or more to reverse one, with past attempts to block DPRK-linked flows enacted and then walked back. That capability isn’t hypothetical. In a May vault exploit, THORChain’s own incident report shows automatic solvency controls first paused signing and transactions across multiple chains after roughly $10.7 million was stolen, node operators then layered on a manual pause, and a Mimir vote fully halted transactions, signing, chain observation and validator rotation within about two hours, according to Baiyi Finance. THORChain’s published emergency procedures describe a make pause function as a “red button that stops everything,” letting node operators initiate a 720-block network-wide pause that other operators can extend, or vote through Mimir to pause signing on a single connected chain. What the documentation doesn’t describe, per that same reporting, is an equivalent mechanism for selectively blacklisting one wallet while letting every other swap continue.

Reactions Split Along a Familiar Line

THORChain rejected Bitget’s request to block addresses tied to the hack, defending its “permissionless” architecture and stating it is “as decentralized and permissionless as Bitcoin, Ethereum and BNB Chain,” while asking what responsibility those networks bear when known stolen funds pass through them, according to Baiyi Finance. Bitget CEO Gracy Chen pushed back publicly, writing that “decentralization is a design principle, not a shield for facilitating known stolen funds,” per the same report. OKX founder Star Xu added a separate critique, arguing that THORChain’s validator set collectively controls assets held in TSS vaults and can move them once a signature threshold is met, describing the protocol as an intermediary between users and native chains and noting that “decentralizing an intermediary doesn’t eliminate the intermediary itself,” according to Baiyi Finance. Security researcher Taylor Monahan separately challenged THORChain’s non-intervention claims, pointing to the network’s established ability to pause operations and coordinate protocol changes. The pattern predates this incident: multiple trackers estimate THORChain has processed over $1 billion in DPRK-attributed funds since 2023, typically by converting stolen ETH into BTC through its cross-chain routing, according to Crypto Briefing.

What to Watch

Bitget says some affected assets have already been frozen through cooperation with exchanges, blockchain projects and security firms, and it now offers a 5% bounty on its recovery program for actions that directly lead to frozen or recovered stolen assets, according to Baiyi Finance. Whether THORChain’s validator set moves to vote on this specific flow through Mimir, as it did during the May exploit, remains an open question, and so does whether regulators start weighing protocols by their actual signing architecture rather than by how they describe themselves.

Sources