Security firm GoPlus is challenging THORChain’s claim that it is as decentralized as Bitcoin or Ethereum, arguing the cross-chain protocol’s own emergency tools prove its validators can freeze flows — a dispute with hundreds of millions of USD in stolen Bitget funds at stake as they move through the network.
By David Chen | September 27, 2026
The Hook: “We Can’t Stop Stolen Funds” — Or Can You?
When hackers steal cryptocurrency, they need to launder it — and one of the most popular laundering routes has been THORChain, a cross-chain protocol that lets users swap assets between different blockchains without a central intermediary. Its defenders have long argued that, like Bitcoin or Ethereum, no one can simply block transactions flowing through it.
On September 27, blockchain security firm GoPlus Security publicly challenged that framing. The firm argued that THORChain’s validator-controlled vaults and emergency governance mechanisms give node operators powers that fundamentally differ from Bitcoin or Ethereum — meaning the protocol does have the ability to stop suspicious flows, if operators choose to use it.
The timing is not accidental. The dispute flared after the September Bitget exchange breach. GoPlus claims roughly 101.5 BTC linked to the incident had already exited through THORChain, while another 27.63 million XRP was being routed toward Bitcoin through the protocol.
The Evidence: THORChain’s Own Rulebook Allows Halts
GoPlus based its argument on THORChain’s own documentation — the protocol’s published emergency procedures describe tools that Bitcoin simply does not have:
- A node operator can issue a “make pause” command when funds face a critical threat. One pause lasts 720 blocks — roughly one hour — and additional nodes can extend the halt.
- Mimir, THORChain’s on-chain governance system, allows node operators to vote on trading halts, chain-specific stops and signing controls.
- Operational Mimir parameters activate after just three node votes, per THORChain’s May exploit report. Four votes can overturn a decision; another five can reinstate it. Economic parameters require a two-thirds supermajority.
The technical root is THORChain’s use of threshold signatures: participating nodes collectively manage the signing of outbound transactions from shared vaults. In plain English, the nodes holding the vault keys must cooperate to move funds — which means enough of them refusing to sign can stop a transaction. Bitcoin has no equivalent chokepoint.
THORChain describes the same design as a security feature that distributes control among independent operators rather than placing vault keys with one entity. Whether that counts as “decentralized enough” is precisely what is being debated.
Proof of Concept: The May Exploit Halt
GoPlus pointed to a live demonstration from THORChain’s own history. On May 15, a malicious validator exploited weaknesses in the protocol’s GG20 Threshold Signature Scheme and reconstructed the private key for one Asgard vault, draining approximately 10.7 million USD before the network fully stopped.
The response proved coordination is possible. Automatic solvency monitoring detected the irregular vault balances and halted signing and trading on several chains. Node operators then coordinated through Discord, stacking manual pauses and Mimir votes — THORChain’s official exploit report says roughly 18 to 20 nodes stacked pause commands, reaching a complete controlled halt within about two hours. The network stayed offline for roughly five weeks, resuming trading on June 23 after patched signing code and governance-approved recovery procedures.
GoPlus’s argument is straightforward: a network that can coordinate a full halt within two hours cannot simultaneously claim it is technically incapable of stopping specific illicit flows.
The Backdrop: Bybit, Lazarus and the 900 Million USD Question
This is not the first time THORChain has sat at the center of a state-sponsored laundering scandal. In February 2025, the FBI formally attributed the theft of approximately 1.5 billion USD from Bybit to North Korea, identifying it as part of the TraderTraitor campaign. The agency specifically urged exchanges, bridges and DeFi services to block transactions involving the stolen addresses.
Most of the stolen 499,000 ETH was converted into Bitcoin within ten days, and Bybit CEO Ben Zhou said around 72% of roughly 900 million USD in converted assets passed through THORChain. During that early laundering window, the protocol recorded 2.91 billion USD in trading volume and about 3 million USD in fee revenue over five days — a grim illustration of how profitable stolen funds can be for the infrastructure that processes them.
As for Bitget: the exchange has not confirmed North Korean involvement in its September breach. It said investigators observed preliminary IP and VPN similarities with previous North Korea-linked activity, but attribution remains unconfirmed.
What This Means for DeFi Users
For ordinary DeFi users, this debate matters in two ways. First, it is a reality check on the word “decentralized.” THORChain is decentralized in some respects — no single company runs it — but its design concentrates emergency powers in the hands of a small validator group. That is a trade-off: it enables rapid response to exploits like May’s, but it also means the “unstoppable” marketing line deserves an asterisk.
Second, regulatory pressure follows this exact argument. If protocols can halt flows but choose not to, expect lawmakers and enforcement agencies to treat them more like financial intermediaries — with all the compliance obligations that entails. The GENIUS and CLARITY debates in Washington are, at heart, about where that line gets drawn.
The Verdict
GoPlus has raised a factual point THORChain’s own documentation supports: the protocol has working emergency tools, and it has used them. Whether validators should freeze suspected stolen funds — as the FBI urged after Bybit — is a governance and ethics question, not a technical one. The Bitget funds moving through the network right now make that question impossible to keep avoiding.
For users, the practical takeaway is simple: cross-chain swaps remain convenient but politically exposed. If you use THORChain or similar protocols, understand that “unstoppable” is a design philosophy, not always a lived reality — and that the industry’s tolerance for laundering-as-usual is shrinking by the month.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
if nine figures of stolen bitget funds is what finally forces the decentralization audit, at least the hack was useful for something
useful stress test or the best ad wasabi ever got, depends which side of the freeze switch you sit lol
Decentralization theater until the first emergency. If validators can pause flows then THORChain is a multisig with extra steps, no matter what their docs claim.
their own docs from the multichain era list the halt powers. extra steps, same multisig
multisig with extra steps lmao, stealing that for the group chat
goplus is right on this one. if validators can halt or freeze flows then unstoppable like bitcoin is marketing, not architecture
the bitget hack money moving through right now is basically a live stress test of the whole claim
stress test with real victims money, which is the grim part. great data, terrible ethics
freezing flows cuts both ways though. today its stolen funds, tomorrow its your withdraw because some validator flagged it
exactly. once you prove the freeze switch works, every regulator on the planet is going to want the manual
MiCA already pressures venues into freeze cooperation. Once the onchain switch is proven to work, the requests move there faster than anyone expects.
This is the comment. Everyone cheers the freeze today because its stolen Bitget money. Wait until a validator flags a regular withdraw during some dispute.
exactly, and the kicker is theres no appeals process onchain. your withdraw gets flagged and youre opening a support ticket with anonymous validators lol
opening a support ticket with anonymous validators is the darkest funny thing ive read today and its completely accurate
An appeals process exists in the docs, a governance vote with a five day notice period. Which is the same as no appeals process for anyone who needed the money yesterday.
unstoppable until politically inconvenient, classic
watching nine figure Bitget funds route through THORChain in real time is the most stressful chain tourism ive seen since the multichain mess
rune holder since 2021 and even im tired of the bitcoin comparisons. just say validators coordinate a halt under emergency conditions and price the risk honestly
The funny part is GoPlus cited THORChain own emergency tooling. Hard to argue with your own documentation.
using their own docs against them is brutal. hard to claim btc level neutrality when you literally ship an emergency stop button
their own docs have an emergency halt section and the response is still censorship resistant like bitcoin. the bar for that comparison is on the floor
censorship resistant like bitcoin while shipping a halt button in the docs. the bar wasnt on the floor it was in the basement
101.5 BTC out and 27.63M XRP mid-flight and the debate is still about wording. either the validators act or the docs were fiction, no third option
halting flows for the stolen bitget millions is the easy case. the real test is a freeze request on a politically messy wallet and we all know how that validator vote goes
We already know how that vote goes. The 2022 halt during the lending mess set the precedent, this is just the first time regulators are watching with nine figures in transit.
the 2022 halt is the receipt, but the lending mess also showed how fast coordination happens when tvl is at stake. nine figures mid hop means that vote is probably already scheduled, not hypothetical
Exactly, 2022 settled this argument already. The switch exists and it has been used, everything since is marketing copy.
the 2022 halt should be pinned at the top of every unstoppable claim. years of marketing undone by one memory
goplus publishing while the bitget funds are mid hop is deliberate timing. pressure the validator set publicly so the freeze question gets answered before the routing finishes