Bybit Hackers Launder Through THORChain, Triggering Record Trading Volume

THORChain, a decentralized cross-chain swap protocol, experienced an unprecedented surge in trading activity as hackers behind the Bybit heist laundered stolen funds through its network. The incident, which took place on February 21, 2025, resulted in the theft of approximately $1.46 million in ETH and other tokens.

On-chain analysts and the FBI have linked the hack to the North Korean Lazarus Group. The group is believed to have used THORChain due to its decentralized nature, which allowed them to obfuscate their identities while converting Ethereum (ETH) into Bitcoin (BTC).

THORChain’s Volume Skyrockets Amidst Laundering

Before the laundering, THORChain’s daily transaction volume averaged around $80 million. However, from February 22 onward, that figure surged to over $580 million per day, totaling $2.91 billion in just five days. On February 26, the protocol processed a record $859.61 million in swaps, followed by an additional $210 million on February 27, bringing its total trading volume to over $1 billion within 48 hours.

This massive increase in activity generated $3 million in fees for THORChain. While this influx of revenue may seem beneficial, it has also drawn regulatory scrutiny and unwanted attention to the protocol.

THORChain Responds to Illicit Transactions

THORChain core developer and Nine Realms engineer, known as “Pluto,” confirmed that illicit funds had passed through the network. In a post on X (formerly Twitter), he stated that the team had worked with wallet providers and integration partners to implement screening services like Elliptic.

When we first started seeing illicit flows on THORChain, our team bridged the gap for wallets and integration partners, helping them integrate screening services like @elliptic. I am pleased to that @SwapKitPowered and @RangoExchange offer this solution to their partners. Any… https://t.co/3yHifg925m

— Pluto (9R) (@Pluto9r) February 22, 2025

“Everyone needs to work together to make a best effort at stopping these flows to the best of our ability without compromising L1 integrity,” Pluto wrote. He emphasized that if Layer 1 (L1) protocols do not take proactive steps, governments may attempt to shut them down.

Despite these efforts, there is no clear evidence that THORChain successfully blocked the hackers from laundering funds.

Were the Hackers Successful?

Blockchain tracking firms, including Chainalysis and Elliptic, traced the movement of stolen assets. Reports indicate that at least $250 million (100,000 ETH) was processed within days, with estimates suggesting up to 20% of the stolen funds—roughly $292 million—had been laundered by February 25.

The hackers used a well-known laundering tactic: swapping ETH for BTC, DAI, and other assets before distributing the funds across multiple wallets. While these efforts helped obscure their trail, blockchain transparency allowed investigators to track some of the stolen funds, leading to portions being frozen.

The Broader Implications

The Bybit hack has reignited concerns over how decentralized protocols handle illicit transactions. THORChain’s permissionless nature made it an attractive tool for laundering, but its transparency also assisted in tracking stolen funds.

Bybit CEO Ben Zhou took a proactive approach, assuring users that funds remained safe despite temporary withdrawal congestion. The exchange also received support from Binance and other industry players to maintain liquidity.

While THORChain’s role in the laundering remains a subject of debate, the incident underscores the challenges decentralized protocols face in balancing privacy, security, and regulatory compliance.