THORChain decentralization faces North Korea's capital flow challenge

GoPlus Security质疑THORChain的“去中心化”主张：节点控制权与比特币、以太坊存在本质差异

GoPlus Security指出，THORChain验证者控制的金库及紧急机制赋予了节点运营商不同于比特币和以太坊的去中心化权力。该机构认为，THORChain不应将其跨链架构与去中心化的Layer 1网络直接相提并论，因为其内部的控制机制允许在特定情况下暂停交易。

核心争议：紧急暂停与签名控制

GoPlus Security于9月27日发表声明称，在解释为何无法阻止被盗资金时，THORChain将其跨链架构与比特币或以太坊等去中心化Layer 1网络进行类比是不成立的。该安全公司指出，THORChain采用阈值签名（TSS）金库、活跃的验证者集合以及紧急治理控制措施，这些特性使其在本质上区别于完全去中心化的共识层网络。

根据THORChain官方文档，当资金面临风险时，节点操作员可以发起“暂停”命令。一次暂停持续720个区块（约一小时），其他节点可延长这一停摆时间。此外，操作员还可以通过Mimir（协议内的链上参数系统）投票决定更针对性的措施，包括交易暂停、特定链停止以及签名控制等紧急行动。

GoPlus emphasized that these control mechanisms make THORChain different from Bitcoin or Ethereum's base-layer consensus. Although THORChain describes this mechanism as decentralizing control to independent node operators rather than centralizing vault keys in one party's hands, it does give operators the ability to stop specific flows of funds when they believe the funds are risky.

Historical precedent: coordinated downtime in May vulnerability incident

GoPlus cited a security incident that occurred in May this year as evidence that THORChain operators have effective tools to stop network activity when security threats reach emergency thresholds.

On May 15, 2025, a malicious verifier took advantage of the weakness of the protocol GG20 threshold signature scheme to reconstruct the private key of an Asgard vault, resulting in the theft of approximately $10.7 million. Subsequently, the automated solvency monitoring system detected abnormal treasury balances and stopped signature and transaction operations on multiple chains. Node operators coordinate through Discord, using manual pauses and Mimir voting to stop transactions, signatures, chain observations, and verifier rotation.

According to official THORChain reports, about 18 to 20 nodes were superimposed with pause orders, achieving fully controlled outages within about two hours after community members issued the alarm. The network operated offline for about five weeks until June 23, when transactions resumed after the introduction of patched signature codes, treasury inspections and government-approved recovery procedures.

Bybit hacking incident and money laundering controversy

The debate over illegal transactions can be traced back to the Bybit hacking incident in February 2025. The FBI has formally blamed North Korea for the theft of approximately $1.5 billion in virtual assets by Bybit and identified it as part of Operation TraderTraitor. The FBI has publicly called on exchanges, bridge services, RPC operators, DeFi services and blockchain companies to block transactions involving stolen asset addresses.

A large number of stolen Ethereum were later converted into Bitcoin through cross-chain services. Bybit CEO Zhou Ben said that 72% of approximately US$900 million in converted assets have passed THORChain. On-chain data shows that in the early stages of money laundering, THORChain recorded US$2.91 billion in trade volume and approximately US$3 million in fee income in five days. GoPlus subsequently estimated transaction volume for the period at approximately US$5.9 billion and handling fees of US$5.5 million, but these figures have not yet been confirmed by THORChain's financial disclosures.

It is worth noting that THORChain had previously tried to prevent the flow of relevant funds. In February 2025, three verifiers voted to suspend Ethereum transactions in response to stolen Bybit funds passed through the protocol, but the action was reversed within minutes. This incident led to heated debate within the community, and some contributors and validators considered withdrawing from the project.

New round of discussions sparked by the Bitget incident

随着9月份Bitget遭受攻击，GoPlus再次将上述论点置于聚光灯下。GoPlus声称，约101.5 BTC（价值约850万美元）已通过THORChain从与Bitget相关的资金流中流出，另有2763万XRP（价值近4300万美元）正通过兑换流向比特币。

Bitget已将确认转移至攻击者控制地址的资产估计值提高至约3.875亿美元，并启动了追讨悬赏计划。GoPlus建议，THORChain可以利用其现有的紧急框架，针对由FBI或OFAC等机构正式识别的地址所关联的资金采取行动。

然而，争议的核心在于：THORChain的文件定义的“紧急事件”主要针对池子或金库本身面临攻击或威胁协议安全的情况，并未明确说明第三方盗窃的资金自动触发协议停机。GoPlus认为，政府机构的官方归因为干预提供了比私人安全公司维护的动态名单更坚实的基础；而THORChain方面则坚持其技术安全紧急程序的适用范围。