TLDR:
- GoPlus says THORChain’s TSS vaults require active signing, unlike Bitcoin and Ethereum’s consensus.
- THORChain’s active validator set stays capped near 100 nodes, churning roughly every three days.
- Pause and Mimir governance tools already let THORChain nodes halt swaps or block certain chains.
- Bybit and Bitget flows through THORChain generated millions in swap fees for the protocol.
THORChain’s decentralization claims are facing direct challenge from GoPlus Security over its handling of DPRK-linked fund flows. GoPlus argued that THORChain should not compare itself to base-layer networks like Bitcoin and Ethereum.
The firm said THORChain’s threshold-signature custody model already includes pause, halt, and governance tools. GoPlus said those tools could block funds tied to North Korea without disrupting the wider network.
Custody Model Draws Renewed Scrutiny
GoPlus said THORChain outbounds rely on threshold signatures from a limited active validator set. On Bitcoin and Ethereum, users control assets directly through their own private keys.
Miners and validators only order and include transactions on those networks. They cannot move a user’s coins without that user’s signature.
THORChain works differently once funds enter a swap. Assets sit inside a shared vault controlled through GG20 threshold signature technology.
Releasing those funds requires an active signing event from the current node set. GoPlus described this as active custody, not passive transaction ordering.
In a public post, GoPlus wrote, “THORChain has never been strictly decentralized.” The firm added, “Distributed centralized custody is not decentralization.”
#THORChain has never been strictly decentralized@THORChain comparing itself to decentralized L1s like BTC and ETH does not hold. Do not enable criminals — or put the industry at risk — just to take swap fees on stolen funds.
1⃣ Custody: TSS vaults ≠ base-layer consensus… https://t.co/x23ZWABnNb pic.twitter.com/D3wD9qG3hX
— GoPlus Security
(@GoPlusSecurity) September 27, 2026
GoPlus also referenced comments from OKX’s Star, who described the protocol as “an intermediary between users and native chains.”
GoPlus argued the distinction matters when illicit funds move through the network. It said miners on Bitcoin cannot be compelled to release stolen assets.
THORChain’s active signers, by contrast, actively produce every outbound transaction. That difference forms the core of the security firm’s argument.
Validator Coordination And Emergency Tools Face Test
THORChain’s active validator set is capped near 100 nodes. According to official documentation, that cap can scale toward 250 or more.
Churn occurs roughly every three days, removing the oldest and lowest-bond nodes. Node operators coordinate in real time through a shared developer channel.
GoPlus said this coordination differs from Bitcoin and Ethereum’s anonymous global validator base. THORChain node votes, known as Mimir, can pause the entire network.
One node can trigger a temporary halt lasting 720 blocks, following what GoPlus called an “abundance of caution.” Node votes can also pause outbound signing on a single chain.
GoPlus pointed to precedent for such intervention. When THORChain itself was drained in May 2026, validators paused the network.
In February 2025, node operators briefly voted to intercept funds linked to North Korea before reversing course. A core contributor who pushed that intercept later left the project.
The firm also cited the financial stakes tied to inaction. It said the Bybit attacker moved nearly 499,000 ETH within ten days, mostly through THORChain.
That flow generated close to $5.9 billion in volume and roughly $5.5 million in fees. GoPlus said a separate case tied to Bitget saw about 101.5 Bitcoin, worth near $8.5 million, exit through THORChain. Another 27.63 million XRP, worth close to $43 million, was mid-swap into Bitcoin.
The post THORChain Faces Custody Scrutiny Over DPRK Fund Movements, GoPlus Says appeared first on Blockonomi.
This articles is written by : Nermeen Nabil Khear Abdelmalak
All rights reserved to : USAGOLDMIES . www.usagoldmines.com
You can Enjoy surfing our website categories and read more content in many fields you may like .
Why USAGoldMines ?
USAGoldMines is a comprehensive website offering the latest in financial, crypto, and technical news. With specialized sections for each category, it provides readers with up-to-date market insights, investment trends, and technological advancements, making it a valuable resource for investors and enthusiasts in the fast-paced financial world.