OKX Founder Star Xu Refutes THORChain's Decentralization Claims
OKX Founder Star Xu: If THORChain can stop, it is not Bitcoin.
Star Xu refuted THORChain's claims of decentralization, stating that when their treasury was emptied in May, node operators paused the entire network within minutes and kept it offline for about 13 hours. A network that can shut down when its own funds are at risk, but refuses to do so when others' funds are at risk, cannot be compared to Bitcoin. Bitcoin cannot be stopped, but THORChain can be stopped; it just chooses when to stop.
The context for this confrontation is that part of the stolen funds from Bitget was transferred via THORChain. THORChain's official stance is that it is decentralized and permissionless, just like Bitcoin, Ethereum, and BNB Chain; if it is known that stolen funds flowed through these three underlying chains, what responsibility do these networks bear? Star's rebuttal focuses on the custody structure: validators collectively control the underlying assets in the threshold signature treasury, and funds can be moved once the signature threshold is reached, thus acting as an intermediary between users and the native chain; splitting the intermediary among multiple parties does not eliminate the intermediary itself.
The incident numbers from May 15 can be verified. The attacker rotated into the active node set two days prior, staked approximately 635,000 RUNE, and exploited a key material leak in the GG20 threshold signature to reconstruct the private key of one Asgard treasury, withdrawing about $10.7 million from a single treasury, while other treasuries remained unaffected. Public tracking includes approximately 3,443 Ethereum, about 36.8 Bitcoin, and other on-chain assets. The payout detection was triggered within minutes, and nodes executed make pause, with the Mimir module freezing transactions, exchanges, liquidity operations, and signatures from block 26190429, with the first pause lasting about 12 hours and 42 minutes.
The downtime did not stop at 13 hours. Exchanges and signatures remained closed during the investigation and patching period, with trading not fully restored until June 23, resulting in over a month offline. During this time, nodes handled recovery through ADR-028 without diluting RUNE holders; malicious node bonds were fully forfeited, and innocent nodes in the same treasury were protected; the protocol released patch v3.18.1, temporarily closed the TSS treasury for audit by Soda Labs, and then added isolation for the compromised treasury and KeyVerify key share checks in v3.19.0, restarting in 11 phased steps. This was the third major security incident for the protocol.
THORChain's self-proving mechanism is also a switch that can be turned off: two-thirds of nodes can adopt code and governance, and Mimir can pause sensitive operations with one click. The official article presents "nodes have the final say, developers cannot unilaterally enforce" as evidence of decentralization; Star interprets the same switch as selective enforcement—when its own treasury was drained, the switch was turned on, but when exchange users' stolen funds were being transferred, the switch was turned off. On the cross-chain side, it is also facing Bitget's demand to refuse service to the attack address and criticism from security agencies that "permissionless cannot be an excuse for exemption from responsibility."
In market mechanics, buyers are traders and market makers who want to exchange native Bitcoin without going through wrapped assets and centralized accounts; sellers are nodes exchanging RUNE bonds for fees and aggregators turning cross-chain traffic into routing income. The event-driven aspect comes from the exposure of the stolen funds' path: funds moved from the hacked exchange wallet into the THORChain treasury and then dispersed to Bitcoin and Ethereum addresses. Benefiting are nodes that can still maintain a narrative of being permissionless and continue to earn exchange fees; under pressure are centralized exchanges that need to intercept stolen funds at the on-chain entry point and RUNE holders who price THORChain as a "decentralized exchange like Bitcoin." Regulatory changes have not yet been formalized, but the pricing power has shifted from "cannot be stopped like Bitcoin" to "nodes decide whether to stop or not."
Source: Public Information
ABAB AI Insight
Star Xu's argument is not the first time he has used "can it be stopped" to measure decentralization. OKX consolidates matching, custody, listing, and risk control under an auditable corporate entity, allowing for card freezes, cross-matching, and cooperation with law enforcement when issues arise; he applies the same standard to THORChain, which is equivalent to demanding that a cross-chain protocol behave like a licensed custodian in scenarios involving stolen funds, rather than like Bitcoin scripts. THORChain's co-founder has long characterized node rotation, two-thirds governance, and TSS sharding as "no single button," but in May, that button was pressed, and it was pressed quite neatly.
The capital path has two layers. One layer is within the protocol: nodes use RUNE bonds to exchange for out-of-station signing rights and fees, with users' native Bitcoin and Ethereum lying in the treasury; once key material leaks, losses first hit the pool and bonds, then are absorbed through forfeiture and POL, rather than relying on insurance companies. The other layer is exchange politics: Bitget wants entry-level interception, while THORChain aims to maintain the narrative of "Bitcoin also does not intercept stolen funds"; Star Xu's emergence effectively shifts the compliance costs of centralized exchanges onto the permissionless routing layer. There is no new equity financing story; what flows is a trust premium— the larger the cross-chain volume, the more it resembles an unlicensed custodian.
The analogy is with cross-chain bridges before and after 2022, rather than Bitcoin. Ronin, Wormhole, and Nomad have all experienced issues with "multi-signature or validators reaching a threshold can move user assets"; THORChain upgraded multi-signature to GG20, changing the attack surface from "a few keys stolen" to "new nodes piecing together a whole key from leaks," but assets remain concentrated in a pausable treasury. The industry's position is colliding with the control period during the expansion phase: aiming to be the largest decentralized entry for native Bitcoin exchanges while needing to retain a total switch like Mimir. Bitcoin scripts have no total switch, centralized exchanges have their total switch in compliance roles, and THORChain hands the total switch to bond nodes.
Structural judgments belong to the transfer of pricing power before regulatory changes. When the network can stop for 13 hours when its own treasury is stolen and stop trading for over a month, the market re-prices "decentralization": the right to stop is itself custodial power. The mechanism is threshold signatures splitting private keys, but ultimately giving disposal rights to the same batch of coordinatable nodes; the faster the coordination, the less it resembles Bitcoin, and the more it resembles a clearinghouse with an emergency committee. Thus, buyers of cross-chain fees begin to ask a harder question—will this channel be closed if something happens to someone else's money?
ABAB News · Cognitive Law
A chain that can be stopped has stopping rights equivalent to custodial rights.
Splitting an intermediary into a hundred parts is still an intermediary.
Rules only activate when one's own treasury is drained; that is not neutrality.