Security firm GoPlus Security publicly challenged the decentralization claims of the THORChain protocol on September 26. The firm argues that THORChain's threshold signature scheme vaults grant validators collective control over outbound transfers, a feature absent in Bitcoin or Ethereum.
The critique followed the Bitget exchange hack, which resulted in losses of $387.5 million. GoPlus identified activity linked to the DPRK within the protocol, noting that approximately 101.5 BTC worth $8.5 million and 27.63 million XRP valued at $43 million were processed via THORChain.
THORChain utilizes a set of around 100 validator nodes to manage multi-chain vaults. The protocol includes a governance mechanism called Mimir, which enables parameter changes and emergency halts. According to GoPlus, these halts require at least 3 validators to enact and 4 to reverse.
OKX founder Star Xu has also questioned the decentralization of the protocol, citing risks associated with collective vault control. Since 2023, various trackers estimate that over $1 billion in funds attributed to DPRK operations have been processed through the THORChain infrastructure.
