OKX Founder Star Xu: If THORChain can stop, it is not Bitcoin.

Star Xu refuted THORChain's claims of decentralization, stating that when their treasury was emptied in May, node operators paused the entire network within minutes and kept it offline for about 13 hours. A network that can shut down when its own funds are at risk, but refuses to do so when others' funds are at risk, cannot be compared to Bitcoin. Bitcoin cannot be stopped, but THORChain can be stopped; it just chooses when to stop.

The context for this confrontation is that part of the stolen funds from Bitget was transferred via THORChain. THORChain's official stance is that it is decentralized and permissionless, just like Bitcoin, Ethereum, and BNB Chain; if it is known that stolen funds flowed through these three underlying chains, what responsibility do these networks bear? Star's rebuttal focuses on the custody structure: validators collectively control the underlying assets in the threshold signature treasury, and funds can be moved once the signature threshold is reached, thus acting as an intermediary between users and the native chain; splitting the intermediary among multiple parties does not eliminate the intermediary itself.

The incident numbers from May 15 can be verified. The attacker rotated into the active node set two days prior, staked approximately 635,000 RUNE, and exploited a key material leak in the GG20 threshold signature to reconstruct the private key of one Asgard treasury, withdrawing about $10.7 million from a single treasury, while other treasuries remained unaffected. Public tracking includes approximately 3,443 Ethereum, about 36.8 Bitcoin, and other on-chain assets. The payout detection was triggered within minutes, and nodes executed make pause, with the Mimir module freezing transactions, exchanges, liquidity operations, and signatures from block 26190429, with the first pause lasting about 12 hours and 42 minutes.

The downtime did not stop at 13 hours. Exchanges and signatures remained closed during the investigation and patching period, with trading not fully restored until June 23, resulting in over a month offline. During this time, nodes handled recovery through ADR-028 without diluting RUNE holders; malicious node bonds were fully forfeited, and innocent nodes in the same treasury were protected; the protocol released patch v3.18.1, temporarily closed the TSS treasury for audit by Soda Labs, and then added isolation for the compromised treasury and KeyVerify key share checks in v3.19.0, restarting in 11 phased steps. This was the third major security incident for the protocol.

THORChain's self-proving mechanism is also a switch that can be turned off: two-thirds of nodes can adopt code and governance, and Mimir can pause sensitive operations with one click. The official article presents "nodes have the final say, developers cannot unilaterally enforce" as evidence of decentralization; Star interprets the same switch as selective enforcement—when its own treasury was drained, the switch was turned on, but when exchange users' stolen funds were being transferred, the switch was turned off. On the cross-chain side, it is also facing Bitget's demand to refuse service to the attack address and criticism from security agencies that "permissionless cannot be an excuse for exemption from responsibility."

In market mechanics, buyers are traders and market makers who want to exchange native Bitcoin without going through wrapped assets and centralized accounts; sellers are nodes exchanging RUNE bonds for fees and aggregators turning cross-chain traffic into routing income. The event-driven aspect comes from the exposure of the stolen funds' path: funds moved from the hacked exchange wallet into the THORChain treasury and then dispersed to Bitcoin and Ethereum addresses. Benefiting are nodes that can still maintain a narrative of being permissionless and continue to earn exchange fees; under pressure are centralized exchanges that need to intercept stolen funds at the on-chain entry point and RUNE holders who price THORChain as a "decentralized exchange like Bitcoin." Regulatory changes have not yet been formalized, but the pricing power has shifted from "cannot be stopped like Bitcoin" to "nodes decide whether to stop or not."

Source: Public Information