Three validators voted to halt the Bybit funds. Four voted to keep the protocol open.

A billion dollars of stolen Bybit ETH flowed through THORChain in ten days. Three validators voted to stop it. Four voted to keep the protocol open. That is not decentralization failing. That is decentralization working. Here is what it means, and why I still believe in it.

On February 21, 2025, at 14:16 UTC, Bybit's signers approved what they believed was a routine cold-to-warm transfer. The Safe{Wallet} signing UI had been compromised roughly 46 hours earlier through a poisoned JavaScript bundle served from a Safe developer's AWS S3 bucket — the malicious JS activated on February 19 at 15:29 UTC and lay dormant until Bybit's signers loaded the page. What the signers actually approved was a contract upgrade. Approximately 499,000 ETH and staking derivatives (stETH and mETH) — roughly $1.46 billion — moved to Lazarus Group wallets in a single block.⁰¹

Within ten days, most of that Ethereum was on Bitcoin.

Between $1.2 billion and $1.3 billion of the haul — about 85% of what was stolen — was converted from ETH to BTC through a single venue: THORChain.⁰⁹ The conversion didn't happen in a dark corner. It happened at the top of the protocol's daily volume charts, in full public view, while forensics firms live-tweeted the flows. On February 26, the day THORChain recorded its highest swap volume in history at $860 million, three validators tried to halt ETH trading. Four validators voted the halt reversed within thirty minutes.¹²

That reversal is the entire story of this editorial.

§ 01 Forty-eight hours

Lazarus had been staging. The cluster of wallets that received Bybit's stolen ETH had commingling links to the Phemex hack (January 23, 2025, ~$37–73M) and the BingX hack (September 2024, ~$52M). ZachXBT submitted on-chain proof to Arkham within hours. The FBI formally attributed the heist to North Korea's TraderTraitor subgroup on February 26, five days in.⁰¹

By then, the swaps were well underway.

The speed was the thing. TRM Labs' Head of Global Policy, Ari Redbord, flagged it publicly: "Criminal financial networks have never been this efficient at processing stolen crypto."¹⁰ Taylor Monahan (MetaMask head of security) told DL News that recovery prospects were "less than 1%."¹³ Elliptic's post-Bybit illicit-address cluster grew to over 11,000 linked wallets — against the FBI's published list of 51. The layering was industrial.

§ 02 The vote

The governance episode is where the story gets interesting, and where a lot of the public discourse gets the mechanics wrong.

On the evening of February 26, three THORChain validators — including the publicly-identified "TCB" — raised the HALTETHTRADING Mimir flag. Mimir is THORChain's live-parameter governance system; operational flags like halt switches pass by signed node transactions, not by forum vote.⁰⁶ The flag did what it was supposed to do. ETH trading was halted.

Within about thirty minutes, four other validators counter-voted. The halt reverted.¹²

THORSwap developer Oleg Petrov explained the asymmetry in the canonical tweet of the crisis:

Halting a chain is an operational setting. It requires 3 node votes to be effective. 4 for be reversed. Decentralization in action.Oleg Petrov, THORSwap dev · X · 2025-02-27

Three to halt. Four to un-halt. The arithmetic of the rule favors transaction continuity. The rule is not a bug — it's the deliberate design choice for a permissionless protocol where minority validators shouldn't be able to permanently seize critical infrastructure. But on the evening of February 26, it meant four nodes were enough to preserve the $1.2 billion pipeline.

The fallout was immediate.

February 27, 2025. "Pluto" (@Pluto9r), a four-year core contributor at Nine Realms, resigned publicly:

Effectively immediately, I will no longer be contributing to THORChain. I will remain available to Nine Realms as long as I am needed and to ensure an orderly hand-off of my responsibilities.Pluto · X · 2025-02-27

This is the same Pluto who, in March 2023, had personally announced a global THORChain halt "out of an abundance of caution" over a credible vulnerability report. The same engineer who had spent the prior week helping front-end partners integrate Elliptic screening. The break was complete.²³

February 27–28. Validator TCB published his "blue car is red" thread:

You can say as many times as you want that a blue car is red, but it won't make THORChain truly decentralized, censorship-resistant and permissionless. It's a handful of actors running all the infra and a handful of corporate actors providing all the user flows — and those corporate actors ALL already censor transactions on their front ends. When the huge majority of your flows are stolen funds from North Korea for the biggest money heist in human history, it will become a national security issue. This isn't a game anymore.@TCB_Bjorn · X · 2025-02-27

TCB threatened to exit. He did not formally resign during the 72-hour window.

February 28, 2025. JP Thorbjornsen, THORChain's founder, posted a multi-thread public defense:

I recommended to all the nodes I delegate with to continue trading. I have not been served by any authority, nor aware of any node that has. It is unrealistic to expect these blockchains to censor, including THORChain. THORChain does not launder money.JP Thorbjornsen · X · 2025-02-28

March 3, 2025. JP posted — and later deleted — a tweet that the MIT Technology Review preserved in its February 2026 profile:

I pushed for all my nodes to unhalt trading. Threatened to yank bond if they didn't comply. Every single one.JP Thorbjornsen · X · 2025-03-03 (deleted; preserved in MIT Technology Review 2026-02-18)

That post is frequently cited as the moment THORChain's decentralization-claim broke. I read it the other way. The mechanism JP used is the one the system actually provides: personal influence backed by personal stake. His leverage came from the RUNE he had bonded, not from any protocol-level admin override. Operators who disagreed had the same lever available and could have used it. They were outvoted. That is not decentralization failing. That is decentralization resolving — in a direction some observers didn't want, but resolving nonetheless.²⁶

§ 03 The architecture

To understand why THORChain specifically became Lazarus's preferred pipeline, you have to understand what it is. It's not a bridge in the conventional sense. It's not a mixer. It's an independent Cosmos-SDK Layer 1 whose validator set jointly custodies native BTC, ETH, BCH, LTC, DOGE, AVAX, and BNB in threshold-signed multisig vaults.⁰⁷

When a user sends native BTC to a THORChain vault with a correctly-formatted memo, the validator set signs a completely separate outbound transaction on Ethereum that releases ETH to the user's destination address. No wrapped token is minted. No custody handoff happens at a centralized intermediary. The memo — a plaintext 80–250 byte field attached to the inbound — specifies the destination.

Four architectural consequences follow from that design — and yes, each also happens to make post-hoc chain-analysis harder. It's worth being precise about what is a design goal versus a side effect.

Native-asset in/out defeats wrapped-token forensics. On a wrapped-BTC DEX swap, there's always a custodian mint/burn event. With THORChain, the BTC arriving at the destination has on-chain provenance of "received from an Asgard vault UTXO that itself received thousands of unrelated UTXOs." There's no token-contract trail, no custodian to subpoena.

Streaming swaps fragment a trade across time. A $10M swap can be split into 50–100 sub-swaps over minutes or hours. The destination receives dozens of irregularly-timed UTXOs from rotating Asgard addresses. UTXO clustering heuristics — the technique analysts use to infer "these inputs are controlled together" — struggles with the opposite: many independently-originated UTXOs that look superficially unrelated. Streaming swaps are enabled by default in the Advanced Swap Queue.

The memo decouples sender from receiver. A sender's BTC deposit address on the Bitcoin chain has no cryptographic relationship to the destination ETH address specified in the memo. No signature link. No address derivation. From a chain-analyst's view, this is the cross-chain equivalent of the unlinkability CoinJoin provides on a single chain — except now the two sides are on different chains with different address formats.

There's no frontend kill-switch the protocol respects. Block a user on THORSwap's UI and they can use Asgardex. Block them on Asgardex and they can use Vultisig, Shapeshift, Rango, Thorwallet. Block them on every frontend and they can submit a handwritten transaction to any Asgard vault from any wallet that speaks the memo format. The protocol only sees the inbound. As long as any tool can construct a valid inbound, the protocol processes it.

The governance system has halt primitives. It does not have surgical censorship primitives. You can stop all ETH trading. You cannot block a specific address at deposit time. And crucially — per THORChain's own docs, as of v3.2.0 in February 2025 — the admin Mimir key that might once have been used for emergency single-party intervention was permanently retired.⁰⁷

That last part matters. JP Thor's later claim that "there was simply no design in the code that allowed [them]" halt the flows is technically correct about one thing: the admin override was gone. But the Mimir-based halt mechanism was alive, voted, and reversed. The machinery worked. The votes weren't there.

§ 04 The pattern

This wasn't the first time. It probably won't be the last.

The list of DPRK-attributed crypto hacks where Lazarus-controlled funds demonstrably moved through THORChain goes back to at least June 2023:

The total documented and verifiable THORChain-routed illicit footprint — restricted to cases with specific dollar figures from primary forensics firms — exceeds $1.5 billion over thirty months. Chainalysis, in an estimate it described as "conservative," put THORChain validator and wallet fees from the Bybit episode alone at $12 million.⁰⁹ JP Thorbjornsen's own disclosure on the Australian 7 News Spotlight documentary put THORChain's protocol fees from the Bybit swap window "between $5 and $10 million."¹⁵

Pattern identification is not prejudgment. A protocol cannot control what users route through it any more than Ethereum mainnet can refuse to mine transactions. But a cumulative $1.5B+ across 34 months is a footprint. It's what the forensics firms describe. It's what the public data shows. It's what Bybit's own CEO said on March 4, 2025.¹⁴

§ 05 The law

The legal scaffolding around all of this has actually gotten stronger in the last year, not weaker — and this is where the editorial has to sit with something inconvenient for its own critics.

Start with Tornado Cash. On August 8, 2022, OFAC added Tornado Cash's smart contracts to the SDN list, alleging the contracts had processed more than $7 billion in criminally-sourced cryptocurrency, including over $455 million of Lazarus proceeds. Coinbase funded a lawsuit. Six Tornado Cash users, led by Joseph Van Loon, sued Treasury in the Western District of Texas. The district court sided with Treasury. Plaintiffs appealed.

On November 26, 2024, a unanimous three-judge Fifth Circuit panel reversed. The opinion — Van Loon v. Department of the Treasury, No. 23-50669 — is the single most consequential legal text for the entire DeFi-sanctions debate.⁰²

The core analytical move:

Although the statute does not define "property," property has a plain meaning: It is capable of being owned. The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.Fifth Circuit Court of Appeals · Van Loon v. Treasury · November 26, 2024

Ownership, the court held, requires both control and the right to exclude. Applied to immutable contracts, "it is not possible for anyone, including the managers of Tornado Cash, to exclude anyone else from using the smart contracts" — so "no one can 'exclude' anyone from using the Tornado Cash pool smart contracts." The immutable contracts were therefore beyond the scope of OFAC's IEEPA authority.³⁰

The court deliberately distinguished mutable from immutable contracts — leaving OFAC's sanctions against Tornado Cash's mutable components intact. The key-point carve-out: once a smart contract becomes immutable, control is gone, and so is the ownership predicate that OFAC needs.

On March 21, 2025, Treasury delisted Tornado Cash and ~100 associated ETH addresses.⁰³ The delist was framed as "discretionary" — Treasury did not concede the Fifth Circuit had compelled it — but the practical effect was the same. The delist was grounded in "novel legal and policy issues raised by use of financial sanctions against financial and commercial activity occurring within evolving technology and legal environments."

Two weeks later, on April 7, 2025, Deputy Attorney General Todd Blanche issued the "Ending Regulation By Prosecution" memo: "the Department of Justice will no longer target virtual currency exchanges, mixing and tumbling services, and offline wallets for the acts of their end users." Acting AAG Matthew Galeotti added: "Our view is that merely writing code, without ill intent, is not a crime."³¹

On August 6, 2025, a SDNY jury returned a split verdict against Tornado Cash developer Roman Storm — convicting on conspiracy to operate an unlicensed money transmitting business (max 5 years), but deadlocking on the more serious felony charges (max 20 years each). DOJ announced a retrial of the deadlocked counts for October 2026.³¹

What does all this mean for THORChain specifically?

No direct sanctions exist. As of April 23, 2026, OFAC has not designated THORChain, Nine Realms, any core validator, or JP Thorbjornsen on the SDN list. There is nothing to delist.

The Van Loon framework partially protects the core protocol. THORChain's consensus-bound validator logic and its Asgard vault custody are much closer to the Tornado Cash immutable contracts the Fifth Circuit protected than they are to the mutable admin-keyed services the court left exposed. The v3.2.0 retirement of the admin Mimir key tightened that protection — no party can unilaterally upgrade or freeze.

Individual operators remain exposed. A former Treasury official, quoted by CoinDesk in April 2025, drew the line clearly:

Anybody making money on fees related to the movement of hacked funds that have already been publicly attributed to Lazarus and North Korea potentially has an OFAC issue.Former U.S. Treasury official, via CoinDesk · April 7, 2025

The target of this theory is not "THORChain" as a protocol — it's individual US-reachable node operators and front-end operators who earned fees on funds they knew, at the time, were Lazarus proceeds. That exposure is real. It's narrow. It's also a live question.¹⁵

The FinCEN non-custody line matters. Both the Samourai Wallet developers (pled guilty, 5- and 4-year sentences)³³ and the Tornado Cash case turned on whether publishing non-custodial code amounts to operating an unlicensed money transmitter. The DeFi Education Fund quotes FinCEN's own 2019 guidance that "anonymizing software providers are not subject to money transmitter rules." The Storm jury's deadlock on the more serious felony charges — while convicting on the narrower MSB count — suggests this distinction has traction even with lay jurors.

The honest summary: post-Van Loon, the US government cannot directly sanction immutable autonomous code. The DOJ can still pursue individuals. The Storm retrial will be the next test. The legal scaffolding THORChain defenders rely on is real — not unlimited, but real.

§ 06 The ledger

How much did THORChain validators earn?

Those are real fees. They are also, on reflection, exactly the fees a public permissionless validator set is supposed to earn for doing what the code says it does. Ethereum validators are paid gas to include transactions they did not choose. Bitcoin miners are paid block rewards to sequence transactions in the mempool, including BTC sent to OFAC-sanctioned wallets. Infrastructure is paid for running — not for curating who gets to use it. That is the entire architectural position.

The critical framing of those fees goes like this: a former U.S. Treasury official, quoted anonymously by CoinDesk in April 2025, said "anybody making money on fees related to the movement of hacked funds that have already been publicly attributed to Lazarus and North Korea potentially has an OFAC issue."¹⁵ I disagree with that theory. It treats fee-earning as participation in the user's predicate acts. By that logic, every Bitcoin miner who sequenced a transaction sending funds to an OFAC-sanctioned wallet has an OFAC issue; every Ethereum validator who included a Tornado Cash deposit transaction has an OFAC issue; every colocation provider who hosted the physical node earning those fees has one too. The theory does not survive application at scale.

What remains is a narrow political risk to individual US-reachable node operators. That risk is real in the sense that a prosecutor could charge it. It is not real in the sense that the legal theory would likely survive appellate scrutiny after Van Loon. The right response is to organize, fund defense, and push back — not to capitulate by building compliance theater into the protocol layer.

Nine Realms was measured during the 72-hour Bybit window. The official @THORChain account was quiet. Asgardex, Vultisig, and the other front-ends made no grand public statements.⁰⁸ That restraint has been framed as cowardice. I read it as institutional discipline. In an active crisis, public statements from a corporate-adjacent entity can be introduced in court as evidence of centralization, intent, or knowledge. The lawyers who advised silence were doing their job.

§ 07 The counterfactual

One argument deserves direct engagement because it is the strongest critical claim in the room. In January 2025, five weeks before the Bybit hack, THORChain paused itself.

THORFi — the protocol's Savers and Lending product — had accumulated roughly $200M in BTC/ETH liabilities that could not be serviced without crashing RUNE. On January 23, 2025, four nodes voted to pause Lending. Within minutes, Nine Realms proposed pausing THORFi entirely via node vote. Multiple nodes voted to suspend both products within minutes. The resolution: issue a new equity token called TCY, 200M supply, 1 TCY per $1 of defaulted debt. Dragonfly Capital called it "the first on-chain restructuring."²⁸

Five weeks later, the same protocol with the same validators could not assemble a halt quorum for the Bybit flows.

Critics read those two data points as hypocrisy. Taylor Monahan's version, to CoinDesk on April 7, 2025:

When THORChain was involved in previous North Korean laundering operations, we were told there was nothing they could do about the illicit funds. The entire time, JP had a single private key that had control over the entire system.Taylor Monahan, MetaMask · via CoinDesk · April 7, 2025

I read the two data points differently. They are categorically different decisions.

THORFi was a protocol-survival question. The protocol itself was carrying an insolvency on its own books. Halting the affected product was internal housekeeping — the protocol deciding how to manage its own obligations to its own liquidity providers. That is exactly what the 2022 "halt early, halt often" guidance refers to: operational self-defense when the protocol's internal state is at risk.

Bybit was a completely different question. It was about whether validators should adjudicate the source of third-party user funds and decide whom the protocol will serve based on that adjudication. Those aren't the same call. Halting a product to protect the protocol's own solvency is internal governance. Halting swaps because users' counterparty funds have a disfavored origin is deputizing the validator set as a compliance layer. The mechanism can be identical in both cases; the decision is categorically different. Validators voted to be infrastructure, not deputies. That is a defensible choice — arguably, the only one consistent with what a permissionless protocol is for.

Monahan's claim that JP had "a single private key that had control over the entire system" refers to the pre-v3.2.0 admin Mimir key. That key was permanently retired in February 2025. Whatever the historical picture was, the present state is that no admin override exists. Crediting her critique, v3.2.0 represents the exact fix she would presumably endorse.

§ 08 What this is actually about

I'll say what I think directly.

The responsibility stack for the Bybit money is not complicated.

Bybit had a security failure. A compromised Safe{Wallet} UI served malicious JavaScript to their signers, and their signers approved a contract upgrade they did not understand. That is Bybit's problem. Governments can and should investigate whether Bybit's infrastructure and signing procedures met the standards their users were entitled to. That is where the primary liability sits — with the custodian that held the $1.46 billion.

Lazarus Group committed a crime. The FBI, OFAC, the UN Panel of Experts, and every national law-enforcement apparatus involved can pursue them, and are already doing so. The DPRK weapons program benefits from crypto heists; that is a live foreign-policy issue and the appropriate tools are sanctions on DPRK, indictments, infrastructure disruption, and bounties. None of those tools require turning a permissionless public protocol into a deputized compliance layer.

The off-ramps — the centralized exchanges, OTC desks, and fiat on-ramps where these funds ultimately try to exit into dollars — are the actual compliance choke points. They have KYC obligations. They have legal money-services-business status. When they fail (eXch refusing to freeze; Huione processing $3.4B in illicit flow in 2024 alone), those are legitimate regulatory enforcement targets, and several such targets have been acted on — eXch seized by German authorities in April 2025; Sinbad seized by Treasury in November 2023.

THORChain's validators running code that converts native BTC to native ETH are none of those parties. They are not the custodian who lost the funds. They are not the attacker who stole them. They are not the off-ramp who converts them to fiat. They are a set of nodes running software that does exactly what the software says it does, paid in protocol fees for doing so — the same way Ethereum validators are paid gas to include transactions they did not choose, and Bitcoin miners are paid block rewards for sequencing every transaction in the mempool, including ones that send BTC to sanctioned addresses.

Those are swaps. Infrastructure does not choose whom to serve. That is the design goal, not an unfortunate side effect. It is the entire point.

The vision I signed up for — the one LeoDex exists to express — is that people should be able to freely move their own money across blockchains without asking permission. How you got the money is your responsibility and the responsibility of where you got it from. If the money was stolen, the victim, the attacker, and the receiver each have specific legal obligations that predate and exist independent of the protocol. The infrastructure that processes the swap does not inherit those obligations.

This is where the slippery slope matters, and it matters a lot.

Today the argument is: THORChain should stop the Bybit funds because they are indisputably criminal. Fine — today's case is easy. Tomorrow the argument will be: THORChain should stop swaps from country X, or political faction Y, or any group a current government currently disfavors. The legal standard will keep moving. Sanction lists are political artifacts; they are not fixed points. A protocol that decides it will start refusing swaps based on the current political consensus about who is criminal has made itself into a tool of whoever currently holds that consensus. That tool doesn't get to choose how it's used next. Once you open that door, it does not close.

This is why I hold the position I hold.

Protocols like THORChain should not be judge, jury, and executioner on the source of user funds. DEX interfaces like LeoDex should not either — we screen at our frontend because that is where our compliance surface lives; we touch users directly. The protocols we route through don't. That distinction is not an accounting convenience; it's an architectural truth. Users are whom we serve. Protocols are what we connect to. Those are different categories of thing with different legal and moral weight.

Three practical threads follow.

First, the legal scaffolding. Van Loon v. Treasury got the law right. Immutable autonomous code is not property under IEEPA. Treasury agreed, delisting Tornado Cash in March 2025. The DOJ under the Blanche memo agreed: "Our view is that merely writing code, without ill intent, is not a crime." The civil-liberties coalition that fought for this outcome — Coin Center, the DeFi Education Fund, the Blockchain Association, the EFF, academic cryptographers like Matt Green, lawyers like Amanda Tuminelli and Jake Chervinsky — was right. Their argument should continue to prevail as the Eleventh Circuit split forces the question upward. Support their work.

Second, the governance question. Decentralized governance means the people running the infrastructure decide what the infrastructure does, within the bounds of the code. If you disagree with how THORChain's validator set handled the Bybit flows, the correct response is to lobby node operators, become one yourself, bond RUNE, and vote the halt next time. Or fund a node that will. Or write a proposal to change the Mimir halt thresholds. Or build a competing venue. All of those are inside the system. The "the protocol should self-censor by fiat" demand is outside the system. If your lobbying doesn't work — welcome to decentralization. That is the deal.

JP's deleted March 3 tweet is frequently cited as the moment decentralization broke.

I pushed for all my nodes to unhalt trading. Threatened to yank bond if they didn't comply. Every single one.JP Thorbjornsen · X · 2025-03-03 (deleted, preserved in MIT Tech Review)

I read it the opposite way. What JP did is exactly what the system provides: he used personal influence backed by personal stake to produce a vote outcome. His leverage came from bonded RUNE, not from a protocol-level admin key. Operators who disagreed had the same lever available. They lost the vote. That is decentralization resolving — in a direction some observers did not want, but resolving nonetheless. If the outcome bothers you, the path to changing it is inside the governance system, not outside it.²⁶

Third, LeoDex. We will continue to aggregate THORChain. It is one of the deepest cross-chain BTC/ETH execution venues in the industry, and for users swapping their own funds on their own addresses it is often the best route. We will continue to screen at our frontend. We will continue to route around flagged counterparties at the UI layer — because that is where our compliance surface lives. We will also continue to reject the frame that makes the protocol or its validators morally responsible for what users route through them.

The obvious critique. Someone on X will read this and say: LeoDex is defending THORChain because they aggregate THORChain. Fair critique on the surface. Yes, we route through THORChain. The piece is a position, not a disinterested audit. Read it as the position and judge the argument on its merits. I hold this view independent of whether we aggregate THORChain. LeoDex aggregates THORChain because I hold this view.

The KelpDAO vector. Five days ago, ~$175M in Lazarus-attributed funds from the KelpDAO rsETH exploit moved through THORChain and Chainflip to Bitcoin in 36 hours. The same playbook. The same pattern. The appropriate response is the legal and policy response — sanctions on DPRK, prosecution of attackers, enforcement against compromised and non-cooperating off-ramps. Not more pressure on a neutral protocol to appoint itself financial police.²¹

The world we are trying to build is one where you can move your own money without asking permission. That world has tradeoffs. I think the tradeoffs are worth it. I'd rather say that out loud than pretend I hold a different position than the one I actually hold.