THORChain's Decentralization Claims Under Fire Over Custody Model and North Korean Ties

THORChain is facing scrutiny over its custody model and handling of North Korean-linked fund flows. GoPlus Security argues that THORChain's threshold-signature custody model, which relies on a limited active validator set, does not align with the decentralization claims made by the protocol.

GoPlus pointed out that assets entering a swap sit inside a shared vault controlled through GG20 threshold signature technology, requiring an active signing event from the current node set to release funds. This is in contrast to base-layer networks like Bitcoin and Ethereum, where users control their assets directly through private keys.

The security firm also referenced comments from OKX's Star, who described THORChain as 'an intermediary between users and native chains.' GoPlus argued that this distinction matters when illicit funds move through the network, citing a case in February 2025 where node operators briefly voted to intercept funds linked to North Korea before reversing course.

The financial stakes tied to inaction are significant, with Bybit and Bitget flows through THORChain generating millions in swap fees for the protocol. In one instance, nearly $5.9 billion in volume was moved through THORChain, mostly through swaps, with roughly $5.5 million in fees.