THORChain's Decentralization Claims Challenged by GoPlus Security Amid North Korea Ties
GoPlus Security has challenged THORChain's claims of decentralization after it was revealed that the protocol processed funds linked to North Korea in the wake of the Bitget hack. The hack resulted in losses of around $387.5 million, and GoPlus identified approximately 101.5 BTC (valued at about $8.5 million) and 27.63 million XRP (worth around $43 million) as being processed through THORChain during the incident.
The security firm argues that THORChain's threshold signature scheme (TSS) vaults give active validators shared control over outbound transfers, which is a structural difference from Bitcoin or Ethereum where users hold their own private keys. This means that validators can collectively refuse to sign transactions, undermining the protocol's decentralization claims.
GoPlus notes that THORChain has processed over $1 billion in funds attributed to DPRK operations since at least 2023, with the typical pattern involving converting stolen ETH into BTC using the protocol's cross-chain capabilities. The firm argues that validators can collectively halt transactions, making it look more like a financial intermediary than a base-layer blockchain.