GoPlus Security has challenged THORChain’s claims of decentralization, arguing that its threshold-signature vaults, active validator set and emergency governance tools give node operators powers that differ from Bitcoin and Ethereum. The dispute has resurfaced after alleged Bitget-linked funds moved through THORChain. GoPlus says about 101.5 BTC, worth roughly $8.5 million, exited through the protocol, while another 27.63 million XRP, valued near $43 million, was being routed toward Bitcoin. Those figures are GoPlus’s tracing estimates and have not been confirmed by Bitget or THORChain. THORChain’s documentation allows node operators to pause activity for 720 blocks, or roughly one hour, extend halts, and use Mimir (the protocol’s on-chain parameter system) to approve trading, chain-specific and signing controls. The protocol used similar measures after a May 15 exploit drained approximately $10.7 million from an Asgard vault, reaching a complete controlled halt within around two hours and remaining offline for roughly five weeks before trading resumed June 23. The wider debate began with the February 2025 Bybit hack, which the FBI (U.S. federal investigative agency) attributed to North Korea and linked to the TraderTraitor campaign. The agency urged exchanges, bridges, RPC operators, DeFi services and blockchain companies to block transactions involving the stolen assets. Bybit CEO Ben Zhou said about 72% of roughly $900 million in converted assets passed through THORChain. Bitget has not publicly confirmed North Korean responsibility for its September attack, citing only preliminary IP and VPN similarities with earlier North Korea-linked activity. GoPlus argues that official attribution by agencies such as the FBI or OFAC (U.S. sanctions agency) could justify using THORChain’s emergency framework, while THORChain’s published procedures address threats to its own pools and vaults without stating that every external theft requires a halt.