GoPlus Security Says THORChain Validators Could Block North Korea-Linked Funds From Bitget Hack, Unlike Bitcoin or Ethereum

GoPlus Security put THORChain in an uncomfortable spot on September 26 and 27. The blockchain security firm says the protocol's validators have the technical power to freeze suspicious transactions. It says they simply didn't use it when funds tied to North Korea allegedly flowed through.

The timing matters. One day before GoPlus went public with its critique, the Bitget exchange got hit for roughly $387.5 million, according to Crypto Briefing. Bitget told investigators it saw preliminary IP and VPN similarities to past North Korea-linked activity, crypto.news reported, but the exchange has not confirmed Pyongyang was behind the attack. Attribution remains unconfirmed.

What isn't in dispute: GoPlus tracked about 101.5 BTC, worth roughly $8.5 million, and about 27.63 million XRP, worth roughly $43 million, moving through THORChain during the incident, with the XRP being swapped toward Bitcoin. That's over $51 million in flagged funds that used THORChain's infrastructure to move and convert.

The core argument: keys versus votes

Bitcoin and Ethereum work the way most people think crypto works. Users hold their own private keys. No committee of validators can vote to seize or freeze a specific person's coins.

THORChain works differently. It's a cross-chain swap protocol built around threshold signature scheme (TSS) vaults, run by an active validator set capped around 100 nodes that churns roughly every three days, according to Ground News. Moving funds out of those vaults requires active signing from participating validators, not a single user's private key.

That structural difference is GoPlus's whole argument. THORChain's own documentation, cited by crypto.news, lays out an emergency system called Mimir. A node operator can issue a "make pause" command that halts activity for about 720 blocks, roughly an hour. Beyond that, three or more validators can vote to enact a longer halt, and four or more votes can reverse it. Economic parameter changes require a two-thirds supermajority.

GoPlus says THORChain has used exactly this system before, just not against North Korea. On May 15, a malicious validator exploited a weakness in the protocol's GG20 TSS scheme and reconstructed the private key for one vault, according to crypto.news. About $10.7 million drained before automatic solvency monitoring flagged the irregular balances and node operators coordinated through Discord to halt signing and trading with manual pauses and Mimir votes.

So the capability exists. GoPlus's point is that THORChain used it to protect itself in May, but past attempts to block North Korea-linked flows through the same mechanism were enacted and then reversed, per Crypto Briefing.

THORChain's defense

THORChain isn't taking this lying down. The protocol has publicly rejected responsibility for the Bitget theft, stating that no authority can approve or block transactions on its network and that decentralized protocols "do not require permission attributes," according to ChainCatcher.

That's a coherent position. If a protocol builds in the ability to override user transactions whenever validators decide something looks bad, it's no longer permissionless in any meaningful sense. Plenty of legitimate crypto users don't want a validator committee making judgment calls about which transactions get to go through. The entire pitch of decentralized finance is that nobody has to ask permission.

The problem is THORChain has been marketing itself as "decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain," per Crypto Paradise, while simultaneously operating a governance system with vote thresholds specifically designed to halt and reverse transactions. You can't claim Bitcoin-style neutrality and also run a validator override switch. Pick one.

The pile-on

GoPlus isn't alone. OKX founder Star Xu publicly disputed THORChain's decentralization claims on X, according to Crypto Briefing and ChainCatcher. SlowMist's analyst known as Yuxian went further, arguing THORChain claims "decentralization and non-interference" while continuing to collect swap fees on transactions tied to hackers, per Crypto Paradise.

That fee point has teeth. ChainCatcher's related coverage notes THORChain's daily revenue had reached roughly $381,700 as of September 27, putting it on pace for a five-month high. Large swap volume from illicit fund flows generates real revenue for the protocol and its RUNE token holders. That's a direct financial incentive sitting right next to the decision not to intervene.

What's unresolved

No regulator has opened a formal investigation into THORChain over these flows, and no charges have been filed against the protocol or its validators. Whether Bitget's attackers actually were North Korean operatives, as opposed to criminals mimicking known DPRK tactics, remains unconfirmed by Bitget itself.

The practical question is whether THORChain's validator set will ever vote to block funds tied to a sanctioned state actor the way it moved to protect its own vaults in May. So far, according to GoPlus, past attempts to freeze North Korea-linked flows through Mimir have been enacted and then reversed. Nobody has explained why.