preferred on
Points of Focus
- Campbell said THORChain’s off-switch could give the DOJ a cleaner case than Tornado Cash.
- THORChain halted or paused operations in 2021, 2025, and 2026, yet $387.5 million stolen from Bitget kept moving.
- TRM Labs found North Korean wallet links but no definitive attribution; no DOJ filing against THORChain had been announced by Sept. 30.
Austin Campbell, founder of Zero Knowledge Consulting, said THORChain’s inaction after the Bitget hack gives the US Justice Department a cleaner case than Tornado Cash.
Campbell made the argument on Unchained’s Sept. 28 Bits + Bips segment, which Laura Shin shared on X.
"THORChain voluntarily chose to launder sanctioned funds for the North Koreans. There are consequences for that."
Austin on why THORChain is a cleaner DOJ case than Tornado Cash
"This is where I think the THORChain folks have now got themselves in a serious pickle. You showed… https://t.co/S5xqkjyYdy pic.twitter.com/KwlFt2dePE
— Laura Shin (@laurashin) September 28, 2026
Bitget CEO Gracy Chen asked THORChain on Sept. 26 to refuse service to addresses tied to the Sept. 24 $387.5-million hack. THORChain replied on Sept. 28 that its halt mechanism is an emergency tool and cannot freeze specific funds or individual swaps.
Swaps continued after the request: An address on Bitget’s attacker list swapped 9,999 XRP (XRP) for Bitcoin (BTC) on Sept. 27. On Sept. 28, a wallet linked to the attacker swapped 2,390 Ether (ETH) for 75.2 BTC.
How THORChain halted itself in 2021, 2025, and 2026
Campbell said THORChain showed it can stop its chain during exploits and chose not to act here. THORChain’s records document three such stoppages:
- In July 2021, node operators halted the network after two ETH router exploits left THORChain with about $16 million in insolvency.
- On Jan. 24, 2025, node votes paused THORFi lending and savers, which had around $200 million in outstanding liabilities.
- On May 15, 2026, an attacker who entered the validator set drained about $10.7 million from one of five Asgard vaults. An automatic solvency check halted trading and signing across several chains within 52 minutes. Node operators then stacked manual pauses and used Mimir votes to bring the wider network to a halt. The network restarted June 23 after about five weeks offline.
Trading is live again on THORChain.
After more than a month offline, the network is fully back. Signing, churning, secured and trade assets, LP actions, and swaps are all up and running. The world's leading Bitcoin DEX is open for business once again.
This recovery was never…
— THORChain (@THORChain) June 23, 2026
Why control separates THORChain from Tornado Cash
Campbell frames those halts as evidence of elective control over the network. The DOJ’s position also matters in this case. Acting Assistant Attorney General Matthew Galeotti said on Aug. 21, 2025, that the DOJ wouldn’t approve new Section 1960(b)(1)(C) charges against truly decentralized software that only automates peer-to-peer transactions, where third parties lack custody and control of user assets.
OKX founder Star Xu argued on Sept. 26 that THORChain validators jointly control vault assets through threshold signatures. GoPlus Security made a similar argument, citing node powers to halt outbound signing. THORChain’s May 2026 exploit report says three nodes can activate an operational Mimir setting and four can overturn it.
I don’t think THORChain’s TSS + validator model represents true decentralization.
The selected validators set collectively controls the underlying assets in the TSS vaults. Once the signing threshold is reached, those validators can move the funds. So from a custody perspective,… https://t.co/nEajr1ZLzz
— Star_OKX (@star_okx) September 26, 2026
Campbell contrasted this with Tornado Cash, the decentralized, non-custodial crypto mixing service, which he said was never turned off. A jury convicted Tornado Cash founder Roman Storm in August 2025 of conspiring to operate an unlicensed money-transmitting business but did not reach verdicts on money-laundering and sanctions charges. His retrial on those counts is set for April 26, 2027.
Protective halts, unconfirmed attribution, and an unresolved precedent
THORChain said on Sept. 26 that it is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. Its documentation lists halts that stop swaps on one chain or stop trading on every connected chain.
We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved.
THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain.
What responsibility should Bitcoin, Ethereum, and BNB Chain bear when… https://t.co/ArvP6N1w3F
— THORChain (@THORChain) September 26, 2026
Campbell said THORChain “voluntarily chose to launder sanctioned funds for the North Koreans.” TRM Labs, however, cited wallet overlaps with earlier North Korean hacks while withholding definitive attribution of the Bitget theft.
No Justice Department filing against THORChain had been announced as of Sept. 30.
Share
Most read articles
