THORChain Says It Can't Block North Korean Laundering. Is That True?

THORChain’s central defense is that it has no built-in way to censor a particular transaction or wallet, and that reaching the two-thirds node consensus needed for major intervention takes about three days on average and can take up to two weeks. Chad Baraford argues that stopping specific laundering flows quickly would require greater centralization, contrary to the protocol’s design. Critics counter that the network has other ways to pause trading and that even imperfect intervention could make laundering harder.

Taylor Monahan says illicit actors have used THORChain’s streaming swaps for three to four years, and argues that the network has acted before despite claiming it cannot. Chad says an “Admin Key” held by co-founder JP was misleadingly named: it could change configuration, but nodes could override it and it could not move funds. It was used to pause lending during the THORFi incident, he says, and was later removed from the codebase. Taylor questions why the network could not use similar measures to stop routes carrying stolen funds, including an XRP-to-ETH route she says was almost entirely made up of stolen assets during the period she cited.

The participants dispute both the available tools and the cost of using them. Taylor says ETH or BTC trading could have been halted, potentially refunding swaps tied to the BitCat hack; a separate “make pause” function lets one node halt all chains for about an hour. Chad says pausing trading could shut down the system and its revenue for one or two weeks, while redirecting in-flight trades would require two-thirds approval and could also take one or two weeks. One speaker argues that blocking a known address would not work for long because attackers can change addresses faster than a decentralized protocol can respond. The disagreement is whether these imperfect interventions would meaningfully obstruct theft or impose excessive harm on users and the network.

THORChain’s control is also contested. The host cites a little over 100 active nodes, about 54 operator addresses, and four operators running 39 nodes, enough to exceed the one-third threshold for blocking signing or consensus. Chad estimates the network’s Nakamoto coefficient at four, compared with about three for Bitcoin and roughly one or two for Ethereum, depending on the definition. He says validators could censor transactions with a two-thirds majority; critics argue that this makes claims of powerlessness less convincing. Chad recalls that validators who tried to pause trading around the Bybit hack lost overwhelmingly, and estimates about 20 validators left afterward. He says the network has since grown to 115 validators, including standby validators.

The rules for dissent are another point of friction. THORChain’s ban mechanism requires a two-thirds majority and can take a node operator’s bond; it has been used once against an attacker who stole $10 million from the protocol. Taylor says operators told her they feared slashing or losing their bond if they opposed the crowd or refused to process DPRK funds, and describes potential penalties as coercive. Another speaker says an operator who refuses transactions could lose some rewards, not principal, and says the ban has never been proposed over a difference of opinion. Chad attributes departures after Bybit to the shock of the unusually large loss, not threats to seize validators’ funds.

The scale and nature of the activity remain disputed. Chad cites about $125 billion in THORChain volume over several years and estimates illicit funds at roughly 1%–2% of activity, while acknowledging that DPRK-related funds can dominate particular routes for a time. The interviewer cites estimates of $10 million to $12 million in fees in a week with $1.3 billion in volume; Chad says illicit flows account for a small share of revenue over the network’s history, and that the development fund receives about 5% of fees. THORChain’s defender says swaps are visible and the protocol does not mix or obfuscate funds; critics say transparency does not excuse failing to act. The centralized, treasury-controlled swap.thorchain.org interface screens addresses through the Bybit API, but is separate from the decentralized protocol. Chad says nodes could choose to deploy a shield like Near Intents’, which reportedly blocked an attempted $50 million laundering flow and froze $500,000 mid-swap, but he had not assessed its technical implications and doubted validators would adopt one.

The debate over whether THORChain is merely software or an intermediary turns on its TSS vaults, whose signing threshold lets validators collectively control and move underlying assets. Chad disputes that this makes THORChain meaningfully different from other protocols, while the host notes that some regulations depend on custody and control. Chad says he is not an attorney and that conversations with lawyers and government officials have not suggested wrongdoing; another speaker argues that bonded, identifiable operators may distinguish THORChain from systems that only automate peer-to-peer transactions. The episode leaves unresolved whether the network should adopt stronger checks, whether operators could safely oppose a majority, and whether Bitcoin miners should reject funds linked to North Korea after they pass through THORChain.