Thorchain is experiencing a developer exodus, as hackers from Lazarus Group are using the interoperability-focused blockchain to launder Ethereum (ETH) stolen in the Bybit hack.
A Thorchain developer known as TCB announced that Pluto, the protocol’s unofficial lead developer, is stepping down. TCB himself has also indicated his imminent departure unless a swift resolution is implemented to prevent illicit flows linked to North Korean actors.
TCB’s statement highlighted a long-standing divide between Thorchain’s messaging around decentralization and the reality of its infrastructure.
According to the developer, the protocol claims to be censorship-resistant and permissionless, but in reality, a small group of corporate actors control most of the network’s infrastructure and user-facing services. He argued that this contradiction exposes the protocol to regulatory scrutiny and threatens its long-term viability.
Thorchain is a permissionless protocol focused on interoperability. However, given its feature of swapping native assets on their respective blockchains, bad actors have leveraged Thorchain’s infrastructure to obscure stolen funds. This is the case following the Bybit hack, which resulted in $1.5 billion lost on Feb. 21.
Recently, TCB, Pluto, and another developer known as Oleg Petrov used their power as validators to vote to halt ETH trading on Thorchain to prevent Lazarus Group from laundering money.
Centralization and validator limitations
Thorchain’s design choices have contributed to what TCB describes as an overly centralized network incapable of withstanding regulatory pressure.
Unlike Ethereum and Bitcoin (BTC), which boast thousands of independent validators, Thorchain relies on a smaller, tightly controlled group of operators. The network’s requirement for full infrastructure replication across all supported blockchains further complicates validator onboarding, limiting decentralization.
Efforts to address these concerns, including proposals for lighter node implementations and an expanded validator set, have been met with resistance.
While other protocols, such as Chainflip, have swiftly implemented censorship measures at the network level, Thorchain has yet to adopt similar strategies, which contradicts industry trends.
Crisis on the horizon
According to TCB, many wallet providers that facilitate the bulk of Thorchain’s non-illicit transaction volume already enforce transaction filtering on their frontends. If Thorchain continues to allow illicit funds to flow through its network, these providers may sever their integrations, further isolating the protocol from legitimate liquidity sources.
TCB warned that the departure of these providers, combined with regulatory scrutiny, could result in a crisis for Thorchain. With major infrastructure providers and developers now reconsidering their involvement, the protocol faces operational and reputational risks.
The concerns raised reflect broader industry tensions between decentralization ideals and the realities of compliance with global anti-money laundering frameworks. The potential for Thorchain to be implicated in North Korea’s largest-ever crypto theft raises the stakes significantly.
TCB asserted that when most transaction flows consist of stolen funds linked to a sanctioned state actor, the issue moves beyond protocol governance and into national security territory. He added that Thorchain may face enforcement actions that could jeopardize its operations if it is perceived as a conduit for large-scale money laundering.
Mentioned in this article
