preferred on
Points of Focus
- GoPlus Security challenged THORChain’s comparison with Bitcoin and Ethereum, arguing that THORChain validators have greater control over outbound transactions.
- The security company said around 101.5 BTC worth roughly $8.5 million linked to the Bitget hack had already moved through THORChain.
- GoPlus pointed to THORChain’s emergency pause, chain-specific signing halt, and governance mechanisms as evidence that intervention is technically possible.
GoPlus Security has challenged THORChain’s decentralization argument as stolen assets linked to the Bitget hack continue moving through the cross-chain protocol.
In a Sept. 27 X post, the blockchain security company argued that THORChain should not compare itself directly with decentralized layer-1 networks such as Bitcoin and Ethereum when defending its inability to block illicit transactions.
❗️ #THORChain has never been strictly decentralized@THORChain comparing itself to decentralized L1s like BTC and ETH does not hold. Do not enable criminals — or put the industry at risk — just to take swap fees on stolen funds.
1️⃣ Custody: TSS vaults ≠ base-layer consensus… https://t.co/x23ZWABnNb pic.twitter.com/D3wD9qG3hX
— GoPlus Security 🚦 (@GoPlusSecurity) September 27, 2026
The criticism follows a request from Bitget CEO Gracy Chen for THORChain to refuse service to publicly identified attacker addresses.
According to GoPlus, around 101.5 BTC, worth approximately $8.5 million, had already exited through THORChain, while another 27.63 million XRP (XRP), valued at roughly $43 million, was being routed toward Bitcoin.
The 27.63-million-XRP figure is also consistent with an earlier Bitquery snapshot, which tracked that amount moving onward from two accounts associated with the Bitget breach. However, the transactions do not establish that all of those assets were sold or identify the ultimate controllers of the destination wallets.
Why GoPlus says THORChain is different from Bitcoin
GoPlus focused its argument on how THORChain processes outbound transactions.
THORChain uses threshold-signature vaults, requiring its active node set to collectively sign outbound transactions. GoPlus argued that this makes the protocol structurally different from Bitcoin and Ethereum, where users retain control of their assets through their own keys.
The company also pointed to THORChain’s documented emergency controls.
A node can trigger a temporary network pause, while node votes can halt outbound signing for individual chains. THORChain’s Mimir governance system also allows nodes to change network parameters and halt trading or signing under certain circumstances.
GoPlus argued that these mechanisms undermine the claim that THORChain is technically incapable of intervening.
It also cited THORChain’s response to its own May 2026 security incident, when the protocol used a controlled halt after approximately $10.7 million was drained from a vault.
THORChain defends its permissionless model
THORChain has pushed back against calls to block transactions, arguing that it operates as decentralized, permissionless infrastructure and raising the comparison with networks such as Bitcoin and Ethereum.
GoPlus disputes that comparison, arguing that THORChain’s vault architecture and emergency controls create intervention capabilities that base-layer networks do not share.
Importantly, attribution of the Bitget attack itself to North Korea remains publicly unconfirmed. Bitget has cited preliminary similarities with previous North Korean-linked activity, but that does not establish DPRK responsibility for the breach.
Share
Most read articles
