THORChain Is Repeatedly Used by Hackers to Launder Money but Remains Decentralized and Permissionless.

On Sept. 27, BlockBeats reported that THORChain, a cross-chain decentralized liquidity protocol, has declined to block attacker addresses despite being linked to repeated security incidents and a reported laundering volume of about 9.27 billion dollars. The protocol argues that it remains decentralized and permissionless, while Bitget CEO has formally demanded that it stop serving stolen-fund flows. The episode turns a familiar DeFi question into a concrete one: when an open protocol becomes a path for criminal funds, does the absence of gatekeepers count as neutrality or as a market failure.

Repeated exploits and a 39-day trading halt

THORChain has faced multiple security events since 2021. In July 2021, two consecutive fake deposit attacks caused combined losses of about 16 million dollars. On May 15, 2026, a malicious node operator exploited a vulnerability in the GG20 threshold signature scheme, reconstructed a vault private key and drained about 10.7 million dollars from a single Asgard vault. The stolen assets involved Bitcoin, Ethereum, BNB Chain, Base and other chains.

A threshold signature system is meant to require multiple parties before a vault action can be authorized. The report indicates that the GG20 flaw allowed one malicious operator to reconstruct a key that should have been controlled collectively. The incident also showed why cross-chain liquidity protocols can concentrate risk: one vault can hold assets tied to several networks at once.

Together with incidents such as theft from the founder's personal wallet, cumulative losses have approached 25 million dollars. The protocol suspended trading for 39 days after the vault incident and only resumed operations after security upgrades.

Why stolen funds keep moving through THORChain

The protocol's design has made it more than a victim of hacks. Because THORChain does not require wrapped assets and allows direct cross-chain swaps, especially ETH to BTC, analysts have identified it as a convenient route for laundering stolen crypto. Wrapped assets usually require a tokenized version of an asset on another chain; swapping directly avoids some of those steps, but it also makes the path faster and harder to interrupt.

The report said that after the February 2025 Bybit hack, which involved about 1.4 billion dollars and was described in the report as the largest crypto theft case, North Korea's Lazarus Group moved about 1.2 billion dollars, or 85%, of the stolen funds through THORChain. Node operators earned millions of dollars in fees from that flow.

In April 2026, about 175 million dollars of the approximately 300 million dollars involved in the KelpDAO hack also moved through the protocol. THORChain also appeared in cases linked to the FTX hacker, WazirX and Atomic Wallet.

Analysis cited in the report said that between 2023 and 2026 there were at least seven confirmed laundering events, with about 9.27 billion dollars in illegal transaction volume processed through THORChain. The protocol and its liquidity providers received about 12.47 million dollars in fees. Those figures show the tension at the center of the debate: the same fee structure that rewards operators and liquidity providers can also make the network attractive to funds that need rapid movement.

The neutrality question after a formal demand

Bitget CEO formally asked THORChain to refuse service to attacker addresses. THORChain responded that the protocol, like Bitcoin, Ethereum and BNB Chain, is a decentralized and permissionless network. In that framing, no single organization can decide which addresses are legitimate enough to use the protocol.

The community had previously voted on whether to block related addresses, but did not do so, citing decentralization and no censorship. A lead developer resigned amid the pressure. Supporters say the protocol's behavior reflects the nature of open infrastructure. Critics say it provides an easy channel for criminal funds, sharpening the dispute over DeFi neutrality and responsibility.

This sequence of events highlights the long-running tension between cross-chain convenience, security and compliance. For users, the practical question is not whether THORChain has been hacked before, but whether the incentives created by open swapping can be reconciled with the need to keep stolen assets out of circulation.