THORChain has a fascinating history. It has processed an awful lot of ex-hack and ex-theft money over the years. The project lied about being decentralized for years . The leader could not appear more suspicious if he tried .
So when Bitget asked THORChain to block some addresses following an attack on Bitget and THORChain refused on technical grounds THORChain was not breaking new ground. What followed was an incredible interview with a so-called "expert" packed wall-to-wall with errors. And some technical commentary that made far more nuanced, less damning and far harder to adjudicate points. This measured commentary was also far less consequential in that the claims were not of any sort of grand illegality. They sat in stark contrast to the high profile interview riddled with problems. And most of the public chatter here is either unreasonably negative on THORChain but short on accuracy, or unreasonably positive on THORChain and also short on accuracy.
We are going to try to untangle this mess. The real story, in our view, has three essential plot points. First up: yes, THORChain was completely centralized and the team lied about this for years. Almost surely crimes were committed, even if only of the generic "unlicensed money transmission" flavour that nobody seems to care about anymore. We will sketch this a little bit below but, really, this is old news and not relevant to current activities. The team put themselves in a bad spot by lying for years.
Second: THORChain is not run by the best imaginable group of software engineers and their procedures and such look a bit sloppy. They also have a long history of security problems and some of the way they deal with their own shortcomings – they absolutely have a solid history of building defective software! – is less than ideal. This is a problem across web3 and in our view the THORChain team are no less competent than their self-described "expert" critics.
And third: the attacks on THORChain's current operation are mostly borne of ignorance, built atop falsehoods and misrepresentations, and fail to recognize that applying the same standards to other projects is to call many many large services outlaw. As we will see, if THORChain's current setup is outlaw then surely a large number of other large projects are too.
So here is a story of people that live in glass houses and seem to want to start a stone-throwing fight.
History
For years THORChain had central admin keys that held pretty much arbitrary control over the platform. We published a relatively detailed technical piece in September 2024 working through much of this. To us this was old news at that time. Many of the code changes linked in that piece date to 2020 and 2021. All of that code was, and remains, public. The team lied in English about decentralization but the code was always out there.
We were not the only people to know about this of course. But it does look like nobody else ever bothered to publish an explanation that a half-technical person could actually follow.
Then in February 2025, shortly before the ByBit hack, THORChain announced it was removing these admin controls. That was an admission of sorts that they had always existed and that many accusations the platform was not decentralized were in fact correct.
Reasonable people can disagree over how long following this change it took for the admin controls to properly disappear. The THORChain network runs in epochs with governance processes that extend far longer than a single block. So this is not exactly like a Bitcoin change. And it is not even like a change to Ethereum staking or finality where 10s or 100s of blocks across minutes to maybe hours are sufficient to be sure the change has fully cleared. But this was initiated in February 2025 and was certainly well finished long before, many months before, 2026 began.
So none of the technical features of THORChain's centralized admin were relevant in September 2026. Claiming these things – which absolutely did exist for years – are relevant in a technical discussion of Bitget's request to THORChain is to admit you do not know what you are talking about. Do these prior bad acts maybe help establish a pattern of dishonesty? Sure. And it is reasonable to question if the team is lying now because the team was lying back then. But it is wrong to take proof of past lies as proof current statements are also untrue.
Current Setup
THORChain as of now is an odd system. It is sometimes accused of being a mixer. But it is not a mixer. It does not do a good job at obfuscating flows. Yes the recordkeeping is a bit messy and things could be more accessible. But all the transactions are visible and nothing like a mixer sits in the mix.
What THORChain actually provides is distance, not obfuscation. THORChain is effective for money laundering for two reasons. First, it allows transactions directly to Bitcoin where flows can then be mixed fairly easily. And second, large exchanges accept deposits from THORChain as clean in ways which frankly baffle us.
We discussed this in the New York Times in November 2025. A huge amount of ETH from the ByBit hack poured straight into THORChain. The hackers swapped to BTC and whoever they were trading with kept depositing those ETH to Binance. Presumably the hackers' trading counterparty was swapping those ETH back to BTC to reload THORChain. And round and round it went. It was easy to see this in real-time.
Binance accepted the ETH deposits from THORChain because...yeah we do not know why. As we told the New York Times "Even a bad — maybe even defective — screening tool would spot" that these were hack proceeds. But THORChain is a "legit" service and web3 does not have a problem with fund provenance from services with bad reputations so long as they are not actually mixers. Or at least that was the case in early 2025. Is it still true? We do not know. THORChain still is not a mixer but maybe some services will stop accepting inflows from there. Who knows.
Anyway, as of now THORChain is as decentralized as many other services. We will go through a bit of that shortly. But first it is worth looking at a few of the technical claims about the current setup that have been made to explore how false they are.
The Confused "Expert"
First, we have an "expert" claiming THORChain is a closed-source permissioned project based on this chat excerpt:
Important context here is that Dinosauruss is asserted to be an attacker that eventually joined THORChain as a node operator and successfully attacked the protocol . The chat transcript shows someone struggling to successfully join the network and asking for help on a Discord channel. This was interpreted as follows :
he was unable to churn in actually ? ?
he tried for weeks and then he had to.......join the discord
thats how you have his discord handle and id and know its him
he had to go into discord and share his addresses and info and beg to be let into the super secret room to get the real client code
lmao lol hahahahhahahaha
We will take this line-by-line because it is important. The processing of "churn in" is how THORChain rotates node operators. Then we find a claim it took weeks to get the software working so they could churn in. And that they joined some Discord chats to ask for help and in fact some some help.
Finally, the claim is that this user was unable to join the network until they were allowed into a "super secret room" to get "the real client code."
If true that would be a problem. If you can only join a network by getting access to secret source code then it is not an open network. But this claim is not really true. Yes, THORChain has some odd embargo processes around security problems. But let's look at an actual release, v3.18.0, with code published May 9th, where the discussion above occurred just days before this release:
The release shipped as private binary, with the code to build the release made available at latest by May 9th and an expected production release date of May 12th. Does that mean only certain people could see the "security patches" while they were being developed? For at least some of the time yes it sure does. Does that mean less than 100% of development was done in the open? It sure does. But the code was released before production deployment. All code sits on the developers computer for some period of time before it hits the public. What matters is if the code is public before it gets put into production.
It is simply false that having some kind of security embargo policy renders your project closed-source. We need only present the Linux kernel Embargoed hardware issues policy to prove this beyond all doubt. If your definition of open source excludes Linux then your definition is wrong. So security embargoes and limited periods of non-public code development are accepted. This is not even a situation where the code was released post-deployment. Yes it was not available pre-deployment for as long as it could possibly have been available but that is a far cry from a process where one must "beg to be let into the super secret room to get the real client code."
Yes there is a little bit of complexity around the a library that does some of THORChain's internally developed cryptography. A small bit of code is, the team claims temporarily, not open source because it is security-critical and has had a lot of vulnerability problems. As discussed elsewhere in this column there are small closed-source components to many large web3 systems. And given the track record of bad security software development at THORChain the team does not have a lot of good options with respect to their vulnerable cryptography software. We view this as a minor mark against the team and anyway nothing worse than examples provided below. Once the team made the bad decision to roll their own cryptography the die was cast for problems in the general vicinity.
Now, if somebody wants to claim that web3 projects are only entitled to exemptions from various financial regulations when 100% of development is done in public they are certainly welcome to do so. But this is not only a bar far higher than that accepted by the software industry in general – it is a bar that will exclude nearly everything in web3 production use today. The expert we are addressing here works at MetaMask and as we have documented before parts of MetaMask are not open source and have been closed for years while used in production.
GoPlus's Soft Claims
web3 security firm GoPlus published a piece claiming THORChain has never been strictly decentralized . The first clue this might be a weak argument is the use of "strictly." They did not even decide to lead with some clickbit but already took a soft position. We applaud GoPlus for being honest. And we also want to throw a little shade in their direction for making a noisy entrance without much real content.
The strictest definition of a decentralized protocol we can think of is that it is impossible for anyone to identify a sufficiently large group of participants such that it would be possible to compel the group to make changes to the protocol. In this "strict" sense Bitcoin is not decentralized because we can easily identify enough pool operators to pass 51% of the network and someone could, for example, visit their offices.
Would it be easy to force them to make some changes which are likely bad for Bitcoin? Who knows. But "strictly" can reasonably be interpreted to mean "can we get these changes put through if bring guns to a bunch of pool operators' offices and threaten to shoot them?" And then the answer is "yes." Now this would swap unlicensed money transmission for something a bit harder as the crime of interest but, again, GoPlus said "strictly." If "wrench attacks" are considered a reasonable threat model for securing self-custody then they are surely also a reasonable threat model for strict decentralization.
Most of GoPlus' specific complaints, numbered 2 through 5, all amount to "there is a smallish group that can collude to make arbitrary changes to THORChain." This is true and true of nearly every web3 project. We are not going to debate whether large mining pools render Bitcoin centralized – we are just going to say that using "strictly" as a weasel word here is a sign they know the argument is weak. Every product with a security council has this problem. In some sense everything with a multisig has this problem.
But GoPlus' first claim that "TSS vaults ≠ base-layer consensus" is worth discussing. THORChain uses a different architecture than many bridges and L2s and other things which connect blockchains to other blockchains. The Threshold Signature Scheme (TSS) used by THORChain is odd. Roughly speaking, funds within the THOR ecosystem sit within multisigs where some threshold of "validators" needs to approve outflows. GoPlus claims this is not the same as a "base layer consensus" scheme where the blockchain itself validates individual signatures and all you need to move assets is your own private key on top of a working blockchain. But validators sign blocks as produced, and blocks as produced include user transctions. Without block production transactions do not flow.
For an L1 there is a real difference in form here even if not in function. But for an L2 or a bridge or anything in that general area this is really no different than something like an odd sequencer design. A sole sequencer in an L2 is just a TSS where the threshold is the one sequencer. If you have some more distributed scheme then it is just a TSS where the T is however many parties need to approve a transaction or withdrawal. We will talk about Hyperliquid a bit below but suffice it to say Hyperliquid can be thought of as a dumb TSS too.
Now for an L1 or an L2 or a bridge is there a substantive difference between the validators having the collective ability to block or censor transactions vs a TSS where some quorum of validators need to actively approve (certain kinds of) transactions? If there is a difference it is small. But even acknowledging this is a legitimate question is to acknowledge Arbitrum, base, Hyperliquid, Polygon, Starknet and many many other projects are less decentralized than THORChain. Why? Because participating in the THORChain validation process is less gated than joining a security council or having a team-controlled emergency multisig.
Certainly THORChain is more decentralized than any of those things. There are complaints that THORChain's 100-ish nodes are really operated by only 10s of people. Maybe. Maybe not. Arbitrum froze funds using a 9-of-12 multisig. If your histrionic moaning does not even claim a T below 9 for the TSS yet you defend the Arbitrum action what are you even doing?
If anyone wants to take the position current THORChain is "clearly" an illegal custodial scheme they are arguing a huge swathe of web3 is also outlaw. We have a lot of sympathy for the last point there. A lot of the products named in the preceding paragraph, and others to boot, are in our view obviously illegal custodial schemes. And that can be true with current THORChain sitting on either side of the line. Be careful what you wish for.
Comparisons
The best two comparisons here to show that current THORChain is not too bad are base and Hyperliquid. Is this a relativist argument? Yes. We are arguing that anyone that wants to paint current THORChain as completely beyond the pale must take the same position with respect to many other projects to reveal themselves to be a hypocrite. We expect the later to be the real explanation. But for now we will just focus on facts.
base
We first wrote in August 2023 about base looking like a centralized, custodial system. We wrote a follow-up in July 2026 noting that essentially no progress had been made and the project's public comments over the interim 3 years admitted all our claims were true.
base's problem is that Coinbase controls all the levers and all the money. And Coinbase-controlled infrastructure not only holds all the funds in its sole custody and control, but Coinbase has actively rolled back the chain to address problems before and otherwise used its absolute central authority. Industry coverage generally acknowledges base is just a custodial service run by Coinbase with a bit of gratuitous software on top.
And the entire thing is built around a sole sequencer that needs to keep pushing out messages for bridging transactions to Ethereum to work. Yes, there are mechanisms to work around the Coinbase-operated infrastructure. But that infrastructure can also upgrade the code instantly at any time and take all the funds for itself if it wants. Coinbase has more power over base than the THORChain developers do over THORChain. It is not even close.
In THORChain the risk is the TSS does not give you your funds because the T is not met. In base the risk is that Coinbase decides it wants your money. Those are not identical but they sure are fairly similar. THORChain is, in our view, better.
Hyperliquid
This one looks remarkably like THORChain only worse and more extreme. Hyperliquid takes the possible issues and oddities with THORChain and replaces them with clearly-out-of-bounds simplifications. To get your money off Hyperliquid one of the designated system validator addresses needs to approve your withdrawal through a two-step process. This is a TSS. And as discussed at that link it is a TSS gated by a permissioned set of validators.
And it gets much worse. THORChain may have some embargo issues and the processes for sharing code may not be ideal. But Hyperliquid is just straight-up closed source. There is no debate on this point: Hyperliquid's code is not available to the public.
THORChain also has some kind of strange on-chain governance processes where parameters can be changed and votes are taken and the like. We are not going to get too deeply into the details here because what really matters for the comparison is that Hyperliquid's on-chain governance is supposed to be mediated by a dispute resolution process. But that process is restricted to the team itself and approved participants. So external parties simply cannot participate at all. Again, THORChain's wonky and not-perfect schemes are clearly more open than Hyperliquid's smoke filled back room. The schemes are not even close.
One of the core complaints about THORChain quoted above, once corrected for clear errors and false statements, is that it is awfully difficult for external parties to follow along and participate because the code is often released with little notice and the system is fiddly to run. Those are real gripes and fair enough. But they are qualitatively different from a system that simply does not allow external participation at all and does not publish source code at all.
Discussion
THORChain has a long history of misrepresenting how it works and processing funds straight out of hacks and thefts. THORChain has a lot issues. The THORChain team almost surely has open legal liability.
But that does not mean every complaint about THORChain today is accurate or reasonable. And it certainly does not mean current THORChain is a particularly outlaw product. This is not an effort to defend THORChain or apologize for past bad deeds by the team. It is just being honest about what is happening today. Does doing better today excuse past bad conduct? Not really. But again, it is only fair to attack the team for what they actually did not what you dreamed up they are still doing.
When compared against a lot of major, respected, services today current THORChain looks pretty good. This is maybe 50% because THORChain has improved a lot and 50% because a huge fraction of current services are also misrepresenting the degree to which they remain outlaw. Maybe that should be 60/40 or 20/80 or some other mix. Maybe you view the mix differently. But there is clearly a large measure of both components at play here.
Today THORChain and the team behind the project are in kind of a tough spot because of their past behaviour. Admitting you did lots of crimes before but changed the system as a way of defending against allegations you are criming today...that has obvious problems as a defense strategy.
But we really do not see that they have any choice. THORChain's best course of action is to compare the functionality of the system today and in the past to other more-respected systems with similar problems. There are only two ways the THORChain team avoids law enforcement: staying below the radar or looking like they were doing the best they could and hoping the high level plan is not to arrest everybody . If the plan is to arrest everybody they are already screwed. And staying below the radar screen has not been a viable strategy for some time. Our advice to the THORChain team is based on the simple premise that you must play the cards you are dealt.
So honestly and openly describing how THORChain is of a piece with many other web3 products out there is just about all they can do. We hope they make an effort in this direction primarily because – full disclosure here – it will be very amusing to watch people squirm. Will this likely involve making statements about illegal behaviour by other large projects which are generally considered to be good actors? Yes it will. Is that good for "web3" as a whole? Who knows. But the rest of the ecosystem brought this on themselves by accepting funds out of THORChain when it was clearly an outlaw service and then turning around and unfairly attacking it for things it did not do. Game on then it would seem.
