THORChain, a cross-chain swap protocol, is witnessing a significant surge in activity after the recent $1.4 billion exploit of cryptocurrency exchange Bybit.
On February 26, THORChain processed $859.61 million in swaps, marking its highest-ever daily volume. The following day, an additional $210 million in swaps pushed the total past $1 billion in under 48 hours.
THORChain allows users to exchange assets directly across different blockchains, such as Ether and Bitcoin, without relying on intermediaries.
Illicit Flows and Hacker Tactics
Swapping stolen funds for Bitcoin has become a common tactic among cybercriminal groups. The North Korean state-sponsored hacking group Lazarus, for instance, often converts illicit digital assets into Bitcoin to hide their tracks.
The high swap volume on THORChain may serve as an example of how hackers use such platforms to remain safe. By moving funds across different blockchains, they can obscure the origin of their transactions.
These numbers highlight the challenges that digital asset platforms face in tracking and preventing illicit activities.
Restructuring Amid Financial Challenges
In the wake of these events, THORChain recently announced a 90-day restructuring plan to address pressing financial challenges. The plan calls for a temporary halt to its THORFi services, specifically its lending and savings programs.
Earlier in January, the protocol paused Bitcoin and Ether lending after accumulating roughly $200 million in liabilities. This debt restructuring plan is a response to allegations of insolvency, as THORChain focuses on stabilizing its core operations.
While lending services have been frozen, swap functions continue to operate, reflecting the protocol’s ongoing role in asset exchanges.
Community Response and Developer Defense
Amid these challenges, THORChain core developer Nine Realms engineer known as “Pluto” stepped forward to defend the protocol and advocate for responsible measures against illicit activity.
Pluto explained that when the team first noticed suspicious flows on THORChain, they worked to bridge the gap for wallets and integration partners by helping them integrate screening services like those provided by Elliptic.
He expressed satisfaction that partners such as SwapKit and RangoExchange now offer similar solutions. Pluto stressed that any frontends integrating directly with L1 protocols should adopt such practices.
He warned that without adherence to industry best practices at the second and third layers—such as aggregators and frontends—governments might intervene and shut down critical L1 infrastructure.
Additionally, he cautioned against using these periods to criticize competitors, urging the community to focus on collaborative efforts to curb illicit flows.
Bybit’s Countermeasures
Meanwhile, Bybit has been proactive in managing the fallout from the hack. The exchange has launched a dedicated website to track the laundering of its stolen funds and has offered a bounty to exchanges and other entities that assist in freezing them.
This measure aims to curb the spread of illicit funds and demonstrates Bybit’s commitment to addressing the issue head-on.
THORChain’s record swap volume and its ongoing restructuring underscore a turbulent period in the crypto industry. The protocol’s decision to pause lending services while maintaining active swaps reflects a strategic shift to focus on its core operations amid rising challenges.