THORChain Says It Can't Block North Korean Laundering. Is…

PodcastUnchainedTaylor MonahanOct 7

The discussion examines whether THORChain’s operator structure and custody of vaults distinguish it from truly decentralized software, including under a 2025 Justice Department test cited by the host. Chad describes limits on halting trades and blocking addresses, while Taylor argues that interventions can still create friction; their exchange centers on how much power operators or community consensus should use to stop illicit flows. The conversation also weighs THORChain’s transparency and decentralization claims against operator concentration, validator thresholds, and the possibility of censorship.

DeFi Crypto Regulation Blockchain

Preview · 24 more points in the app

Read the Full Summary

Key Takeaways

Taylor Monahan says illicit actors have used THORChain streaming swaps for about three to four years, and that debates over responding to laundering have recurred across multiple hacks. She also points to earlier North Korean laundering controversies that led developers to quit over how to respond.

The host argues that THORChain’s bonded, identifiable operators jointly custody vaults and sign swap outbounds, which may put it outside a 2025 Justice Department test for truly decentralized software without third-party custody or control. Chad counters that THORChain is a decentralized exchange, not a mixer, and says government contacts in 2022 or 2023 were educational rather than adversarial; Star Xu’s quoted critique similarly focuses on whether threshold signatures eliminate the intermediary role.

THORChain’s intervention powers operate through different thresholds and constraints: Chad says operational MEMIRs can make configuration changes with three or more nodes, while economic MEMIRs and validator bans require a two-thirds majority. The former admin key could pause lending but not reallocate assets, and stopping in-flight trades through a restore migration would take an average of one to two weeks.

The discussion describes several ways to add friction to illicit swaps without claiming they prevent every attempt: Taylor says THORChain could have used trading halts to refund certain Big Cat hack swaps, and cites ShapeShift’s response as making a DAO hacker’s Bitcoin cash-out difficult. Separately, the host says NEAR Intents’ shield risk layer blocked an attempted $50 million in laundered funds, froze $500,000 mid-swap, and planned to return $340,000.

GEO-POLITICS

North Korean Laundering — Taylor Monahan says THORChain has repeatedly faced controversy over North Korean laundering. Developers publicly quit during earlier disputes over how to respond.

“And you've had multiple incidents where there were these controversies about North Korea trying to launder funds through a chain…”—

Bybit Investigation — The host says XBT released an undercover investigation that exposed a Chinese crime syndicate laundering $1.5 billion in Bybit funds.

“So today, XBT released an investigation in which he went undercover and exposed a Chinese crime syndicate that laundered the $1,500,000,000 in Bybit funds.”—

TECHNOLOGY

Illicit Swap History — Taylor Monahan says illicit actors have used THORChain streaming swaps for about three to four years. She argues the debate over responding to laundering has recurred across multiple hacks, not just North Korean ones.

“They've been making this excuse since. Well, since streaming swaps started being used by illicit actors, which has been about three, four years now…”—

Admin Key Limits — Chad says THORChain’s former admin key could change configurations, which nodes could override, but could not control the protocol or reallocate assets. During the ThorFi incident, it was used to pause lending as an interim measure. Reallocating funds required a two-thirds node majority and a subsequent protocol upgrade.

“It doesn't have any authority over the protocol. It can make configuration changes and the nodes can override those changes…”—

Address Ban Limits — Chad says stopping THORChain trading would require in-flight trades to go through a restore migration approved by two-thirds of nodes, taking an average of one to two weeks. He argues an address ban would not stop an attacker from switching addresses and continuing to trade.

“And assuming that there's in flight trades, those have to be reallocated…”—

THORChain Laundering Debate

Shin frames the dispute over whether THORChain could or should intervene when North Korean hackers route stolen funds through crypto protocols.

Censorship And Consensus

Chad says THORChain lacks a fast way to censor individual transactions, while Taylor argues that past incidents show the network has sometimes had ways to act.

Admin Key Authority

Chad describes the former admin key as a limited configuration tool, and the guests debate whether emergency pauses and later consensus actions could have stopped laundering.

Validator Duties And Censorship

The host and guests dispute whether THORChain’s pause mechanisms could have created friction for thieves, and Chad compares intervention with validator responses to protocol exploits.

Vault Custody And Decentralization

The panel examines whether THORChain’s threshold-signed vaults make it an intermediary, and Chad defends the design while explaining why its TSS signing code was temporarily closed.

THORChain Operator Concentration

Shin questions whether a small number of operators can coordinate to halt the network, while Chad compares THORChain’s operator distribution with Bitcoin and Ethereum.

Bybit Dissent And Social Pressure

Taylor says node operators may have faced social and financial pressure after opposing intervention during the Bybit incident, while Chad denies that dissenters were threatened with losing their stake.

Core Developers And Halt Rules

The guests clarify the number of THORChain developers, distinguish operational from economic configuration votes, and debate what front-end address screening means for decentralization.

THORChain And Money Laundering

After discussing a report linking laundering services to THORChain, Taylor argues that protocols should consider social harms, while Chad emphasizes transparency and permissionless access.

DOJ Test And THORChain

Shin raises the DOJ’s custody-and-control framework and compares THORChain’s jointly controlled vaults with Tornado Cash; Chad says legal conversations have not raised concerns.

Validators And Censorship Choices

Chad says a validator majority could choose to censor, while the group discusses exchange risk screening and the limits of labeling all THORChain outflows illicit.

THORChain And North Korea

Chad comments on a cofounder’s North Korean flag display and says he would consider a Near-style intervention only if THORChain validators supported it.

Stolen-Fund Fees And Incentives

Taylor questions whether fees from stolen-fund flows weaken incentives to act; Chad says illicit transactions generate only a small share of THORChain’s long-term income and entertains returning some treasury proceeds.