THORChain says its network halt is an emergency security measure, not a way to freeze specific funds or swaps. It pointed to the May 2026 exploit, when attackers stole $10.7 million from liquidity pools, saying their addresses were never blacklisted and remained free to swap.
THORChain also described the network as permissionless and noncensoring, quoting security researcher Michael Perklin in support of that position.
A THORChain network halt is an emergency security mechanism designed to protect the protocol.
A halt is not a selective freeze of specific funds or an individual swap.
During the May 2026 exploit that resulted in $10.7M stolen from the liquidity pools, the attackers addresses were never blacklisted and therefore never prevented from swapping on THORChain.
THORChain is permissionless and doesn’t censor by design. It’s a neutral public good/tool as described by @mperklin in the post below.
— THORChain (@THORChain) September 28, 2026
The dispute began after GoPlus Security said THORChain was never strictly decentralized and could not be compared with Bitcoin or Ethereum. GoPlus argued that THORChain nodes jointly control the vaults holding user funds and must produce threshold signatures before assets can leave, making the release of stolen funds an active approval rather than simple transaction ordering.
❗️ #THORChain has never been strictly decentralized
@THORChain comparing itself to decentralized L1s like BTC and ETH does not hold. Do not enable criminals — or put the industry at risk — just to take swap fees on stolen funds.
1️⃣ Custody: TSS vaults ≠ base-layer consensus
On BTC/ETH, users control assets with their own keys. Miners/validators order and include txs. They never hold user funds. The worst a single miner can do is refuse to include your tx. They cannot send your coins.
Every THORChain outbound (vault → user/attacker) has to be actively produced by the current active set via a GG20 TSS threshold signature. During a swap, funds sit in a TSS vault jointly controlled by those nodes.
Releasing stolen funds is an active signing event, not “neutral ordering we cannot stop.” As @star_okx put it: from a custody view it is an intermediary between users and native chains. Distributed centralized custody is not decentralization.
2️⃣ Validator set: small, and it can coordinate
Official docs: THORNodes bond RUNE to join. Active-set cap is ~100 (can scale to 250+), with a churn about every 3 days that drops the oldest, slowest, lowest-bond nodes.
Nodes coordinate in real time on Dev Discord’s #mainnet channel — anonymous relays, votes (Mimir / node votes). That is an organization with a comms channel, a voting process, and execution tools. Not BTC/ETH’s globally anonymous set with no coordination path.
3️⃣ Intervention is designed in. There are runbooks. There are precedents.
make pause: one node can halt the network (720 blocks per trigger, stackable). Slogan: “Halt Earn, Halt Often!” Standard is “an abundance of caution.” False trips can be undone with make resume.
Per-chain signing halt: node votes can pause outbound signing on one chain only — the tool needed to stop ETH/BNB → BTC exits without taking the whole network down.
Mimir governance: nodes can vote live to change params, halt trading, halt signing.
Precedent: when THORChain itself was drained in May 2026, they paused and ran a controlled halt to stop further movement.
4️⃣ Inaction pays
In the Bybit case, the attacker washed all 499K ETH in 10 days, mostly through THORChain into BTC. That printed ~$5.9B volume and ~$5.5M fees for THORChain.
In the Bitget case, ~101.5 BTC (≈$8.5M) has already gone out via THORChain, with another ~27.63M XRP (≈$43M) mid-swap into BTC. Potential fee take: hundreds of thousands of dollars.
In Feb 2025, validators voted to intercept DPRK-linked funds, then reversed. Core contributor Pluto, who pushed the intercept, left after that.
5️⃣ “THORChain is just like BTC” mixes up two different systems. See the comparison screenshot.
⚠️ A per-chain halt / outbound reject on FBI- and OFAC-attributed DPRK addresses and funds fits THORChain’s own “funds-at-risk” emergency framework. THORChain should do the job. Do not put the industry at risk for the fee line.
— GoPlus Security 🚦 (@GoPlusSecurity) September 27, 2026
Perklin rejected that comparison, calling it cherry picking and a false equivalence. He argued that Bitcoin miners, Ethereum validators and THORChain node operators can all shut down their systems to stop transactions, but doing so would also block legitimate activity.
This is cherry picking at best, a false equivalency at worst. Either way it wreaks of AI slop.
All tools in existence are inherently neutral by nature. It is the man who wields the tool that decides whether they will use it for good or for bad, and you cannot blame tools for the actions of men.
The slop compared THORChain swaps to “active signing events” to imply there are people waiting in the wings to rubber stamp transfers of criminal proceeds, but that’s not what happens at all.
When a BTC txn gets signed by a criminal, Bitcoin miners can unplug their miners to prevent it from being mined. Ethereum miners can unplug their validators to prevent it from being mined. Thornode operators can unplug their thornodes.
In all 3, there is no active choice to sign, only an active choice to turn off the machine.When internet routers route criminal requests and responses, their operators can “actively” unplug the routers too. Microsoft can delicense the OSes used by criminals, and Dell can unlicense the hardware used by criminals.
But they don’t.
Why don’t all these participants turn their machines off to stop the hundreds of criminal transactions?
Because doing so would also stop the millions of legal transactions too.There are far Far FAR more legitimate reasons to use Bitcoin, Ethereum, routers, switches, computers, OSes, and THORChain. These are all neutral public goods.
We should not ban cars because a criminal used a car.
We can’t ban knives because a murderer used a knife.All tools in existence are inherently neutral by nature. It is the man who wields the tool that decides whether they will use it for good or for bad, and you cannot blame tools for the action of men.
— Michael Perklin (@mperklin) September 27, 2026
His point was that the tools themselves are neutral, and their use should be judged separately from the actions of the people using them.
How much control should a network have?
The argument between THORChain and its critics becomes easier to understand when compared with what happened on Sui. Both cases involve networks that can step in when something goes wrong, but they use that power differently. Sui chose to act after Cetus, its largest decentralized exchange, lost about $223 million in an exploit in May 2025.
Sui’s validators, the computers that confirm transactions, froze about $162 million linked to the attacker, while roughly $63 million had already moved to Ethereum. Days later, validators representing 90.9% of the network’s stake voted to move the frozen funds into a multisignature wallet so they could be returned to affected users.
The freeze saved most of the stolen money, but it also raised the same question now being asked about THORChain: how much control can a network have before people start questioning how decentralized it really is? Sui says its validators work together to secure the network, with their voting power coming from delegated stake. Critics, however, argue that a group of 114 validators with the ability to freeze funds has significant control over what happens on the network. Others saw it differently, saying the validators were using the tools available to them to stop stolen money.
That difference is important to the THORChain debate. THORChain says it does not freeze individual swaps or block specific attackers, while its critics point to the network’s shared vaults and signing system as evidence that its operators have more control over user funds than Bitcoin miners or Ethereum validators.
That question is now playing out in court
The same question comes up in the case of Roman Storm, a co-founder of Tornado Cash. The two systems work differently, but both have raised arguments about how much responsibility should fall on the people behind a crypto system when others use it for illegal activity.
In August 2025, Storm was convicted of conspiring to operate an unlicensed money-transmitting business. The U.S. Department of Justice said Tornado Cash transmitted more than $1 billion in criminal proceeds and argued that Storm and his co-founders continued operating the service while knowing it was being used to move criminal funds. Storm’s defense has focused on the difference between writing or maintaining software and actually controlling users’ money.
GoPlus says THORChain’s nodes do more than order transactions like Bitcoin miners or Ethereum validators. The nodes jointly control the vaults through threshold signatures, meaning several of them must take part before funds can leave. THORChain’s Michael Perklin rejects that view, saying shutting down the network is different from choosing which individual transactions should be allowed.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
