Overview
- GoPlus Security has publicly challenged THORChain’s decentralization claim, arguing that the protocol’s threshold signature (TSS) vaults give an active validator committee shared control over outbound transfers rather than leaving keys solely with users.
- The firm pointed to recent high‑value flows linked by trackers to North Korean actors, saying roughly 101.5 BTC and about 27.63 million XRP from the Bitget breach moved through THORChain and that the earlier Bybit incident saw nearly 499,000 ETH routed largely via the protocol.
- THORChain runs an active validator set capped near 100 nodes that churns frequently and uses on‑chain governance tools called Mimir plus pause commands that let node operators halt signing or trading on specific chains; those controls were used during a May 2026 drain and in a briefly reversed 2025 intercept vote.
- Supporters of THORChain say blocking specific transactions would break protocol neutrality and turn validators into de facto compliance officers, while GoPlus and critics say the ability to stop or sign flows makes the protocol functionally custodial and raises regulatory risk.
- If regulators judge THORChain to be an intermediary because validators can collectively move or block funds, exchanges, users, and node operators could face new legal duties and the protocol could face pressure to change how signing and emergency controls work.