⚠️ THORChain decentralization challenged over DPRK flows

🌐 GoPlus Security has challenged THORChain’s decentralization claims, arguing that its validator-controlled vaults and emergency mechanisms give node operators powers that differ from Bitcoin and Ethereum. GoPlus Security said on Sept. 27 that THORChain should not compare its cross-chain architecture directly with decentralized Layer 1 networks when explaining why stolen funds cannot be blocked. The firm pointed to THORChain’s threshold-signature vaults, active validator set and emergency governance controls.

⚡️ Its criticism follows renewed scrutiny over stolen funds routed through THORChain after the Bitget breach. GoPlus claims around 101.5 BTC linked to the incident had already exited through the protocol, while another 27.63 million XRP was being routed toward Bitcoin.Bitget has not publicly confirmed that North Korean actors carried out its September attack. The exchange said investigators had seen preliminary IP and VPN similarities associated with previous North Korean-linked activity, but attribution remained unconfirmed

🔖 Node operators can then vote on more targeted measures through Mimir, the protocol’s on-chain parameter system. THORChain documentation lists trading halts, chain-specific stops and signing controls among the available emergency actions. GoPlus argued that these controls distinguish THORChain from Bitcoin or Ethereum base-layer consensus. THORChain uses threshold signatures to authorize outbound transactions from shared vaults, meaning participating nodes collectively manage the signing process for cross-chain swaps.