GoPlus questions THORChain's decentralization after Bitget hack funds traced
GoPlus Security argued that THORChain's validator-controlled threshold signature vaults allow validators to collectively block outbound transfers, unlike Bitcoin or Ethereum. The critique came after the roughly $387.5 million Bitget hack, with stolen assets moving through THORChain and activity GoPlus called highly likely tied to North Korea. GoPlus cited about 101.5 BTC worth $8.5 million and 27.63 million XRP worth $43 million processed during the incident.
GoPlus Security’s criticism followed the Bitget breach, which cost about $387.5 million. The firm said roughly 101.5 BTC, worth some $8.5 million, and 27.63 million XRP, valued near $43 million, passed through THORChain, with activity it described as very likely connected to North Korea.
THORChain relies on about 100 validators and TSS vaults, plus a Mimir governance tool for parameter changes and emergency stops. GoPlus noted such halts need at least three validators to start and four to undo; earlier efforts to stop North Korea-linked flows were enacted and later reversed. OKX’s Star Xu has also questioned the protocol’s decentralization.
The debate may affect exchange users, cross-chain traders, and compliance teams, because if validators can theoretically block transfers, expectations around censorship resistance and emergency intervention could shift. Regulators and law enforcement might see such controls as useful for tracing or freezing illicit funds, while privacy-focused users could worry about broader surveillance or selective blocking. The outcome may influence how decentralized cross-chain protocols are judged and how much responsibility their operators are expected to assume.