Can DeFi Stay Neutral When Criminals Exploit It?

THORChain, a prominent decentralized finance (DeFi) protocol, is at the center of a heated debate over decentralization, governance, and criminal exploitation.

Prominent decentralized finance (DeFi) protocol THORChain is being heavily used by the Lazarus Group, a North Korean cybercriminal syndicate, to launder funds stolen from Bybit exchange, according to blockchain analytics firm Crystal Intelligence.

Out of the $1.4 billion stolen from Bybit in March, about 361,255 ETH, or 72% of the total funds, were laundered through THORChain, rendering it the top service used by the hackers for converting stolen Ethereum into Bitcoin (BTC).

The remaining funds were laundered through other services, including Uniswap and OKX DEX, but the majority of funds flowed through THORChain, making it a focal point for scrutiny.

"It's interesting to see how the Lazarus Group prioritized services for optimal laundering. They used a variety of platforms but favored specific ones heavily. For instance, they chose to use THORChain for the majority of ETH to BTC swaps and Union Bank for BTC to fiat transactions," said Federico Paesano, investigations lead at Crystal Intelligence.

"They also used mixers such as Tornado Cash but not to the extent one might expect, suggesting a preference for platforms that offer direct cross-chain swaps and fiat outflows."

Earlier this week, three THORChain validators attempted to halt ETH trading on the platform in a bid to block the Lazarus Group’s transactions. However, four validators quickly voted against the proposal to disable ETH trading on Thursday.

This move sparked heated debate within the THORChain community, with some members arguing that the protocol should not be used to commit unlawful acts.

"It's ironic how quickly the community mobilizes when there's a threat of insolvency but remains largely indifferent to such a large-scale cybercrime," said one community member. "North Korean hackers are stealing billions, and yet we're discussing transaction throughput as if it were a pressing matter."

Another community member added that the fact that four validators voted against disabling ETH trading shows that THORChain is still too centralized and that it is ultimately up to the community to decide what happens.

"If we want to be able to intervene in emergencies, we'll need 1,000+ unique validators on each chain who can quickly cooperate to shut down the network at the network level. Otherwise, we're limited in what we can do. Chainflip was able to prevent transactions at the network level, but we weren't able to."

However, several community members argued that it is not up to the protocol to decide which transactions should or should not be allowed and that doing so would be hypocritical, considering that the protocol has intervened in the past to pause lending due to insolvency risks.

"We've paused lending due to insolvency and intervened when needed before. We're not some passive entity that can't make choices or take sides. But we also choose not to interfere in the past, and that's okay too," said one community member.

"This chaotic scene is a testament to the fact that we're still too centralized to be considered fully autonomous. We're still learning and adapting, and it's a process that will take time. In the meantime, we'll continue to do what we can to protect the protocol and its users."

After three THORChain validators proposed shutting down ETH trading on the platform to block the Lazarus Group's transactions, another four validators voted against the proposal on Thursday.

The move comes after a large-scale hack on Bybit exchange saw North Korean hackers steal an estimated $1.4 billion in cryptocurrency.

Of the stolen funds, 72% were laundered through THORChain, rendering it the top service used by the hackers for converting stolen Ethereum into Bitcoin.

This makes THORChain a focal point for scrutiny as government agencies are increasingly targeting platforms linked to illicit activity.

According to reports by Chainalysis, government agencies seized more than $3.8 billion in cryptocurrency from unlawful activity in 2022, and this figure is set to rise further in 2023.

However, despite the fact that the North Korean hackers' transactions are being tracked and their activity is common knowledge, no government agency has yet intervened to shut down the protocol or impose sanctions on it.

Nevertheless, several community members expressed their annoyance at the fact that the protocol is becoming involved in a manner that could be viewed negatively by external parties.

"This pisses me off. Do we get ETH and BTC nodes to give back their transaction fees? What about GETH or BTCCore devs who write the software funded by grants/donations?" asked THORChain founder John-Paul Thorbjornsen.

"Centralized exchanges happily earn trading fees and prioritize liquid trades, engaging in money laundering optimization. They only act when threatened by regulators. We're not some fiat onramp; we're a decentralized chain capable of making choices."

He added that if anything, As