THORChain Developer Resigns After Vote to Block North Korean Hackers Was Reverted

A core developer of THORChain, a decentralized crosschain swap protocol, has announced their resignation following the reversal of a vote to block transactions linked to North Korean hackers.

Another validator has also threatened to leave, citing concerns over the protocol’s handling of illicit funds.

The developer, known as “Pluto”, stated in a February 27 post on X that they would immediately stop contributing to THORChain but would assist in transitioning responsibilities.

The decision followed a controversial vote by THORChain validators, where some attempted to halt Ether (ETH) transactions on the network to prevent the Lazarus Group, a North Korean state-backed hacking collective, from laundering stolen funds.

THORChain Validators Divided Over Security Risks

One THORChain validator, “TCB”, revealed that they were among three validators who voted to stop ETH trading on the network.

However, the vote was overturned within minutes, as it required only four opposing votes to reverse the decision.

In response, TCB warned that they would also exit THORChain if the network failed to take immediate steps to block North Korean-linked transactions.

I was part of the 3 validators that voted to halt $eth trading on @THORChain

I've been having discussions with @Pluto9r, @ol3gpetrov, @zachxbt and others about blocking the flows from ByBit hack

I hope we get a resolution before a validator resumes trading@ol3gpetrov is…

— TCB (@1984_is_today) February 27, 2025

The Lazarus Group has reportedly been using THORChain to move a portion of the $1.5 billion stolen from crypto exchange Bybit on February 21.

According to Lookonchain, the hackers have already transferred $605 million worth of ETH through the protocol.

Despite the controversy, THORChain’s transaction volume has surged, with the network processing $860 million in swaps on February 26, its highest daily volume ever.

On February 27, it processed another $705 million, reinforcing concerns that illicit funds may be driving the network’s growth.

As pressure mounts, the FBI has urged validators and exchanges to block Lazarus-linked transactions, confirming North Korea’s role in the Bybit hack.

Validator TCB emphasized the severity of the situation, stating:

“When the huge majority of your flows are stolen funds from North Korea for the biggest money heist in human history, it will become a national security issue. This isn’t a game anymore.”

Meanwhile, THORChain founder John-Paul Thorbjornsen distanced himself from the protocol’s governance but defended the platform, arguing that none of the FBI-sanctioned wallet addresses have interacted directly with THORChain.

Thorbjornsen stated that Lazarus Group moves stolen funds faster than existing blockchain screening services can track.

He also argued that expecting blockchains like THORChain to enforce censorship is unrealistic, adding that illicit ETH-to-Bitcoin swaps eventually land on centralized exchanges, where they can be converted to fiat.

I recommended to all the nodes I delegate with to continue trading.

I have checked the OFAC/FBI list and none of those addresses have *ever* interacted with TC. I have not been served by any authority, nor aware of any node that has.

I will support my nodes to run a static… https://t.co/zYghRCGkuZ

— JP (@jpthor) February 28, 2025

Debate Over THORChain’s Decentralization

Validator TCB raised concerns about THORChain’s governance structure, claiming that it is not decentralized enough to survive regulatory pressure.

They noted that the network’s small validator base and corporate-driven infrastructure make it vulnerable.

“You can say as many times as you want that a blue car is red, but it won’t make THORChain truly decentralized, censorship-resistant, and permissionless,” TCB wrote.

They also alleged that many corporate partners providing user access to THORChain already censor transactions, and some may withdraw support if the platform does not address illicit activity.