THORChains Unstoppable Claim Challenged: GoPlus Says Validators Can Freeze Flows as Bitget Funds Move Through

Security firm GoPlus is challenging THORChain’s claim that it is as decentralized as Bitcoin or Ethereum, arguing the cross-chain protocol’s own emergency tools prove its validators can freeze flows — a dispute with hundreds of millions of USD in stolen Bitget funds at stake as they move through the network.

By David Chen | September 27, 2026

The Hook: “We Can’t Stop Stolen Funds” — Or Can You?

When hackers steal cryptocurrency, they need to launder it — and one of the most popular laundering routes has been THORChain, a cross-chain protocol that lets users swap assets between different blockchains without a central intermediary. Its defenders have long argued that, like Bitcoin or Ethereum, no one can simply block transactions flowing through it.

On September 27, blockchain security firm GoPlus Security publicly challenged that framing. The firm argued that THORChain’s validator-controlled vaults and emergency governance mechanisms give node operators powers that fundamentally differ from Bitcoin or Ethereum — meaning the protocol does have the ability to stop suspicious flows, if operators choose to use it.

The timing is not accidental. The dispute flared after the September Bitget exchange breach. GoPlus claims roughly 101.5 BTC linked to the incident had already exited through THORChain, while another 27.63 million XRP was being routed toward Bitcoin through the protocol.

The Evidence: THORChain’s Own Rulebook Allows Halts

GoPlus based its argument on THORChain’s own documentation — the protocol’s published emergency procedures describe tools that Bitcoin simply does not have:

• A node operator can issue a “make pause” command when funds face a critical threat. One pause lasts 720 blocks — roughly one hour — and additional nodes can extend the halt.
• Mimir, THORChain’s on-chain governance system, allows node operators to vote on trading halts, chain-specific stops and signing controls.
• Operational Mimir parameters activate after just three node votes, per THORChain’s May exploit report. Four votes can overturn a decision; another five can reinstate it. Economic parameters require a two-thirds supermajority.

The technical root is THORChain’s use of threshold signatures: participating nodes collectively manage the signing of outbound transactions from shared vaults. In plain English, the nodes holding the vault keys must cooperate to move funds — which means enough of them refusing to sign can stop a transaction. Bitcoin has no equivalent chokepoint.

THORChain describes the same design as a security feature that distributes control among independent operators rather than placing vault keys with one entity. Whether that counts as “decentralized enough” is precisely what is being debated.

Proof of Concept: The May Exploit Halt

GoPlus pointed to a live demonstration from THORChain’s own history. On May 15, a malicious validator exploited weaknesses in the protocol’s GG20 Threshold Signature Scheme and reconstructed the private key for one Asgard vault, draining approximately 10.7 million USD before the network fully stopped.

The response proved coordination is possible. Automatic solvency monitoring detected the irregular vault balances and halted signing and trading on several chains. Node operators then coordinated through Discord, stacking manual pauses and Mimir votes — THORChain’s official exploit report says roughly 18 to 20 nodes stacked pause commands, reaching a complete controlled halt within about two hours. The network stayed offline for roughly five weeks, resuming trading on June 23 after patched signing code and governance-approved recovery procedures.

GoPlus’s argument is straightforward: a network that can coordinate a full halt within two hours cannot simultaneously claim it is technically incapable of stopping specific illicit flows.

The Backdrop: Bybit, Lazarus and the 900 Million USD Question

This is not the first time THORChain has sat at the center of a state-sponsored laundering scandal. In February 2025, the FBI formally attributed the theft of approximately 1.5 billion USD from Bybit to North Korea, identifying it as part of the TraderTraitor campaign. The agency specifically urged exchanges, bridges and DeFi services to block transactions involving the stolen addresses.

Most of the stolen 499,000 ETH was converted into Bitcoin within ten days, and Bybit CEO Ben Zhou said around 72% of roughly 900 million USD in converted assets passed through THORChain. During that early laundering window, the protocol recorded 2.91 billion USD in trading volume and about 3 million USD in fee revenue over five days — a grim illustration of how profitable stolen funds can be for the infrastructure that processes them.

As for Bitget: the exchange has not confirmed North Korean involvement in its September breach. It said investigators observed preliminary IP and VPN similarities with previous North Korea-linked activity, but attribution remains unconfirmed.

What This Means for DeFi Users

For ordinary DeFi users, this debate matters in two ways. First, it is a reality check on the word “decentralized.” THORChain is decentralized in some respects — no single company runs it — but its design concentrates emergency powers in the hands of a small validator group. That is a trade-off: it enables rapid response to exploits like May’s, but it also means the “unstoppable” marketing line deserves an asterisk.

Second, regulatory pressure follows this exact argument. If protocols can halt flows but choose not to, expect lawmakers and enforcement agencies to treat them more like financial intermediaries — with all the compliance obligations that entails. The GENIUS and CLARITY debates in Washington are, at heart, about where that line gets drawn.

The Verdict

GoPlus has raised a factual point THORChain’s own documentation supports: the protocol has working emergency tools, and it has used them. Whether validators should freeze suspected stolen funds — as the FBI urged after Bybit — is a governance and ethics question, not a technical one. The Bitget funds moving through the network right now make that question impossible to keep avoiding.

For users, the practical takeaway is simple: cross-chain swaps remain convenient but politically exposed. If you use THORChain or similar protocols, understand that “unstoppable” is a design philosophy, not always a lived reality — and that the industry’s tolerance for laundering-as-usual is shrinking by the month.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.