THORChain processed $678 million in swaps in the two days after Bitget’s $387.5 million hack and took in almost $1.2 million in fees while refusing to block the attacker’s wallets, according to figures from the protocol’s own analytics page.
The cross-chain protocol has become the main route out of the September 25 breach, one of the largest exchange hacks on record. THORChain’s own numbers, cited by industry press, show volume of $20 million to $60 million a day in the week before the hack. The stolen funds moved through as roughly 101.5 BTC, about $8.5 million, plus around 27.63 million XRP, worth about $43 million, per security firm GoPlus Security.
This is not new for the protocol. ByBit CEO Ben Zhou reported in March 2025 that $0.9 billion of the ETH stolen in the February 2025 ByBit hack, about 72 percent of it, was routed through THORChain, much of it converted into Bitcoin. Multiple trackers estimate more than $1 billion in funds attributed to North Korean operations has crossed the protocol since 2023. Investigator Specter reported volume also spiked after April’s $280 million Kelp DAO hack.
THORChain declined to act when Bitget CEO Gracy Chen formally asked it to refuse service to the publicly listed attacker addresses. In a post on X, the protocol called itself “decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain” and asked what responsibility those chains should bear when handling known stolen funds. In a follow-up on September 28, it said its May 2026 emergency halt, after a $10.7 million vault theft, was a security mechanism and that attacker addresses were never blacklisted then either.
Chen’s own post put the position bluntly: “Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching.”
The fee income gives the dispute a harder edge. The protocol’s gross system income of nearly $1.2 million over two hack-driven days compares with a fraction of that on a normal week, and THORChain has not said whether it will change its policy. It has not responded to GoPlus’s technical critique either, which argues its shared validator vaults and emergency halt thresholds mean the network could block specific transfers if validators chose to.
