A recent analysis by GoPlus Security has reignited debate over THORChain's decentralization, focusing on how its governance mechanisms could affect responses to illicit fund movements. The firm argues that THORChain's validator-controlled vaults and emergency pause functions give node operators capabilities that differ from Bitcoin and Ethereum's base-layer consensus models. According to THORChain's own documentation, operators can initiate emergency pauses, halt chain-specific signing and trigger Mimir-based governance votes when funds face security threats. These controls were activated during the protocol's May incident, where a validator exploited a threshold signature vulnerability to drain approximately $10.7 million from a single vault before the network was fully suspended. The pause mechanism, lasting up to 720 blocks, allows extended coordination through validator voting to restore operations. GoPlus cited these features to challenge comparisons between THORChain and fully decentralized Layer 1 networks, stating that such distinctions matter when addressing stolen asset flows. The firm noted that around 101.5 BTC linked to the Bitget exchange breach had exited through THORChain, while approximately 27.63 million XRP was being routed toward Bitcoin. Bitget has not confirmed North Korean involvement in the September attack, though the FBI previously attributed the February 2025 Bybit theft to that nation and urged services to block related transactions. Crypto.news reported that Bybit's CEO estimated 72% of converted assets from that hack passed through THORChain, with early laundering activity generating over $2.9 billion in volume. GoPlus's later estimate placed total volume at $5.9 billion, though these figures remain unverified by THORChain. The firm suggested that officially designated malicious addresses, such as those identified by the FBI, could justify using THORChain's emergency framework to block flows. This stance contrasts with THORChain's founder, who has opposed dynamic deny lists and supported static lists based on official government data if node operators choose to implement them. The renewed scrutiny follows earlier internal disputes, including a February 2025 vote to halt Ethereum trading that was quickly reversed. While some validators expressed willingness to leave the network without safeguards against North Korean-linked activity, others emphasized the need for protocol-level protections. GoPlus maintains that government-verified threats provide a stronger basis for intervention than private threat assessments, though it acknowledges no confirmed attribution for the Bitget breach. The situation highlights ongoing tensions between cross-chain interoperability, security responsiveness and the limits of decentralized governance in managing illicit asset movements.