THORChain has been called a money laundering protocol — a label no decentralized finance (DeFi) project wants unless it’s prepared to have regulators breathing down its neck.

Its supporters have fended off the criticism by championing decentralization, while its critics point to recent activities that showed some of the protocol’s centralized tendencies.

After exploiting Bybit for $1.4 billion, the North Korean state-backed hackers behind the attack, known as the Lazarus Group, flocked to THORChain, making it their top choice to convert stolen funds from Ether (ETH) to Bitcoin 

BTC$82,340.Lazarus finished converting its Etherwithin just 10 days of the hack.

The controversy has triggered internal conflict, governance cracks and developer resignations, exposing a deeper issue and question: Can DeFi remain neutral when criminals exploit it at scale?

THORChain is not a mixer

THORChain is a decentralized swap protocol, so some say it’s unfair to call it a laundering machine, as the output is traceable. It’s not like a mixer, whose purpose is to conceal cryptocurrency fund trails — though the reasons for using mixers vary between users, with some simply wanting to preserve their privacy and others using them for illicit purposes.

Federico Paesano, investigations lead at Crystal Intelligence, argued in a LinkedIn post that it is misleading to state that the North Korean hackers “laundered” the Bybit hack proceeds.

“So far, there’s been no concealment, only conversion. The stolen ETH have been swapped for BTC using various providers, but every swap is fully traceable. This isn’t laundering; it’s just asset movement across blockchains.”

Hackers also moved funds through Uniswap and OKX DEX, yet THORChain has become the focal point of scrutiny due to the sheer volume of funds that passed through it. In a March 4 X post, Bybit CEO Ben Zhou said that 72% of the stolen funds (361,255 ETH) had flowed through THORChain, far surpassing activity on other DeFi services.