Track market-moving stories before they get noisy

THORSday Community Podcast #244 ft. CBarraford, KentonC137 & Patriotsounds | October 22, 2026 | Watch the full episode on YouTube

By Raynalytics

TL;DRv3.21 was about 13 hours from adoption. Chad expects to cut v3.21.1 next week once two more pull requests merge, and once the paused churn resumes, $XMR is ready to launch.In its second week, SwapKit Rev-Share spent $841.60 in credits on swaps that earned THORChain $3.72K in fees, a 4.4x return that held steady as spending doubled.Chad is turning block time into an adjustable mimir so THORChain can step down from 6 seconds to 2 seconds one second at a time, and step back up without a new binary.About 20% of nodes have started voting to end rewards to liquidity pools. Kenton wants a formal ADR, while Denny and Chad made the case for protocol-owned liquidity (POL) instead.Chad unveiled Visual Review, a tool that turns any code change into an explainer page, and the solvency checker halted a small IBC exploit on its own at a loss of about $800.1. Monero Is Two Pull Requests and a Churn AwayAt recording time, v3.21 was roughly 13 hours from adoption. Chad said two more pull requests need to merge before the team can cut v3.21.1, which he expects next week. The churn is currently paused for issues that v3.21 fixes, so the remaining sequence is: adopt v3.21 and v3.21.1, restart the churn, and launch Monero.

"Once that's out and the churn is churning, we're live." (Chad)A community member asked whether THORChain could be a reorg target, citing the Qubic selfish-mining incidents on Monero. Chad said it comes down to confirmation counting. He described a method JP created years ago: wait enough blocks that the block rewards in that window exceed the value coming into the protocol. More confirmations mean slower trades, but because THORChain has no decentralized competition for $XMR and competes mainly with centralized exchanges, speed matters less at launch. Chad leans toward a higher confirmation count to start, with the exact number still to be researched. For contrast, he recalled Erik Voorhees telling him that ShapeShift used a single confirmation on Bitcoin for its whole history without a reorg incident.

Shielded Zcash addresses are not coming soon. Chad used AI to generate a full implementation in about 12 hours, but it added roughly 20,000 to 30,000 lines of code, and the devs pushed back on the complexity. What tipped Chad was Maya Protocol's data: only about 15% of its Zcash volume uses shielded addresses. The Zcash community is also working on rotating transparent addresses, which Chad expects would need no changes on THORChain's side. He will be at Zcash Foundation's Zcon7 in Cancún next week.

Beyond Monero, BSC is now on Router v6 alongside Base and Avalanche, and churnless chain additions are targeted for the next release or the one after. Asked about Zano, Chad said it is still well back in the queue. He named Substrate-based chains, Bittensor's $TAO and Dash as the short list after Monero, which he called by far the hardest chain THORChain has integrated.

2. SwapKit Rev-Share Holds at 4.4x in Week TwoChad returned to Ray's SwapKit Revenue Share dashboard for a second weekly check-in. Under the 20% Rev-Share, SwapKit has accrued $7.03K in credits and spent $841.60 of it on quote discounts, leaving a $6.19K balance. Swaps carrying those discounts earned THORChain $3.72K in fees, a 4.4x return, slightly below the 4.6x of week one. The discounted swaps added up to $1.96M in volume across 778 swaps, an average of about $2,500 each.

Chad's summary was that the numbers held. Spending roughly doubled over twice the time, and the ratio barely moved, which the hosts called a great sign.

The open question is still scale. Chad expects SwapKit to raise its spending after v3.21, and the hosts noted that the release fixes an affiliate code bug that should let SwapKit add more partners. If the ratio stays around 4.4x to 4.5x, he said raising the share from 20% to 25% would create the flywheel discussed last week, where every dollar SwapKit spends returns more than a dollar to its bucket, until SwapKit's market saturates. Week one is covered in last week's recap.

3. Should THORChain End LP Rewards?Kenton raised a vote already in motion: roughly 20% of nodes, about 27, have started voting to cancel rewards going to liquidity pools. Because it would be a big change to THORChain's economics, he suggested someone write a formal ADR.

The backdrop: for months the incentive pendulum sent nearly all rewards to nodes, then 20% of system income began flowing to POL. Now the pendulum is swinging back, and rewards are reaching legacy LPs again. Kenton's concern is that LPs need $RUNE to outperform to break even, but that same outperformance erodes the value of their accumulating rewards through impermanent loss. He believes POL should replace LPs over time. He also steelmanned the other side: if $RUNE never outperforms enough, those rewards could help pay LPs back. Boone has proposed paying rewards out to LPs directly to shield them from impermanent loss, and wrote in chat that most LPs would not benefit from rewards at current prices because synth leverage is so severe.

Denny, speaking as an LP, backed POL over LP rewards. Ray's POL Income dashboard shows 1.23M $RUNE of system income collected for POL, about $791,500 at current prices. Kenton added that $RUNE tracks volume, volume needs liquidity, and THORChain has lost roughly 75% to 80% of its liquidity since THORFi. He would end the rewards if it were his call, while acknowledging that node operators are also struggling on low yields. Node income is tracked on Ray's THORChain Financials page.

"We are grinding our way out of this hole. It's happening." (Denny)Chad favored POL because it is not mercenary capital. If there were another hack, POL would likely be first in line to absorb losses, rather than the Treasury, which paid for most past incidents. He said he wished THORChain had launched with both streaming swaps and POL from day one. For background, see the recap covering POL's launch.

4. A Gradual Path to 2-Second BlocksChad is revisiting 2-second blocks. The original code was merged about a year and a half ago, then pulled back because a hard switch felt risky and difficult to undo. His new approach is to make block time a mimir rather than a code change, so THORChain can move one step at a time and roll back if needed without releasing a new binary.

"We can walk it down from 6 seconds, what it is now, to 5 seconds to 4 seconds to 3 seconds to 2 seconds." (Chad)His analysis of mainnet suggests 2 seconds is a safe target: about 99% of blocks already complete in under 2 seconds. Around 1.5 seconds might be possible with Cosmos SDK performance gains, but Chad would be cautious. The mimir will be hard-coded to a range of 1 to 10 seconds, and going below 1 second would mean forking or replacing CometBFT, the consensus layer underneath.

On paper, the benefits are clear: streaming swaps would execute three times faster, arbitrage bots would rebalance pools more often, and the Rujira app layer would gain from faster blocks. Chad wants to measure how much of that shows up in practice before pushing lower, and hopes to move ahead within the next month or two. The idea first resurfaced in last week's recap.

5. The Quote-Versus-Fill Test Gets CheaperThe test proposed last week, comparing swap providers' quotes with what users actually receive, is moving forward with Treasury support. Kenton said he and Ray are working out the procedure, and credited Ray for running the numbers. The original plan of $1,000, $10,000 and $100,000 swaps would have meant a few million dollars in volume and, once fees and spreads were included, a cost of a couple hundred thousand dollars. The revised plan uses only $1,000 swaps: around 400 to 500 of them, roughly $400,000 to $500,000 in volume, for a cost of a few thousand dollars. Kenton said THORChain already wins larger quotes, and the low end of the size curve is where it misses volume, so that is the range worth studying.

On marketing, Kenton listed THORChain on a no-KYC exchange directory and asked the community to leave a review. THORChain will appear on the directory's exchange list once it has an XML quote feed, which Liquify agreed to build. He also asked the Unstoppable Wallet devs about Tor (.onion) and I2P addresses for THORChain Swap and set up a THORChain page on Bitcointalk.

Kenton's focus remains AI search. thorchain.org sits in the top 500 of about 120,000 sites on an AI-visibility tracker, though still at a B grade, and new affiliates requesting API keys say they found THORChain through ChatGPT, Claude or Google search. He is also looking into ChatGPT's new advertising, which could open a paid channel crypto lacks on Google.

After a press outlet turned a post about a 140 $RUNE Zcash pool bug into a negative story, Kenton said issues will still be disclosed on Discord and GitLab, but the main X account does not need to spotlight every minor bug.

6. Visual Review Turns Code Changes Into ExplainersChad unveiled Visual Review, a skill he built that turns a code change into a web page explaining it visually. He showed it on his dynamic fee merge request. The page includes a five-minute explainer video with chapters, interactive graphs, and a narrated walkthrough of every changed line, with fuzzy search by file name, function or snippet of code. The goal is to let anyone, technical or not, understand a change before it merges.

"It's my attention and my focus that is the most valuable resource in this process." (Chad)The merge request he showed runs to about 27,000 lines, of which roughly 1,483 are logic changes; the rest are tests and documentation. Huginn will generate these pages automatically, with a button at the top of each pull request. Chad has open-sourced the skill on GitLab, and Kenton added a Visual Review link to the thorchain.org footer during the show.

The dynamic fee change itself replaces the current step search, which moves 1 bps at a time, with a bracket search. Instead of trying 1, 2, 3, 4 and 5 bps, the model jumps from 1 bps to 20 bps, then tests the midpoint and narrows in. Bigger jumps make the market's reaction clearer and reach the best fee in fewer epochs. The change also lets the team switch an affiliate such as Symbiosis off and on to reset its data. Chad hopes to merge it for v3.22.

7. The Solvency Checker Stops an IBC ExploitTHORChain had what Chad called a tiny mini hack this week. A bug in the IBC implementation let an attacker make THORChain believe it had received $ATOM it never received. The first fake deposit was about 16 $ATOM, roughly $20, sent with a bad memo that triggered a refund. The attacker kept doubling that amount across five transactions.

The solvency checker only acts once a shortfall reaches $500, a buffer that avoids halting the chain over small discrepancies. Once that line was crossed, it halted things within about 20 to 30 seconds, with no human involvement, after an attack lasting seven or eight minutes. Chad expects the roughly $800 shortfall to be refilled from the reserve, probably in the next release. In chat, a viewer offered to open a merge request setting the threshold at $42,069.

"It's a success story in my mind, even though it's only $800." (Chad)Chad also wants more math-based safety checks. AI recently helped solve how to account for synthetics in LUVI, a measure that separates pool earnings from price moves and should almost always rise, so it can now act as an invariant that flags broken pool accounting without knowing the cause. LUVI checks were added to regression testing last week, and Chad plans to add them to mainnet code eventually, though it is not a top priority.

A community member also asked why the reserve holds about 25M $RUNE. Chad was not sure and suspects it relates to accounting from the summer hack. Kenton thought a store migration in v3.21 might address it. Long term, Chad said, the reserve would have a cap, with anything above it paid out as system income.

8. Faster CI and Huginn's Growing RoleChad shared a summary of recent changes to THORChain's continuous integration (CI), the automated tests every code change must pass. The team now runs nearly three times as many CI jobs per day, has added more than 1,300 unit tests, and introduced fuzz testing, mutation testing and adversarial-quorum testing. Typical CI time fell from 97 minutes to 24 minutes, and even the worst cases now finish in under 50 minutes, down from waits as long as seven hours.

Asked whether a large language model could formally verify the THORChain stack using Lean, Chad said Lean is a language for mathematical proofs and he does not think it applies to code. Instead, Huginn reviews every change and continuously audits the codebase, tracking which files it has scanned. By Chad's count, Huginn has found more security issues in the past year than every human contributor combined, by orders of magnitude, and it currently reports only the two highest priority levels. A full audit by the security team also turned up a few dozen issues, which are being addressed.

The bottleneck is human review. A community developer recently opened six or seven merge requests; generating one can take five minutes, while reviewing it can cost several engineers 45 minutes each. Chad estimated THORChain could merge 10 to 20 times more code per release without that constraint, though he stressed humans still review everything. Huginn now runs on its own Treasury-funded accounts, which freed Chad's own AI usage for projects like Visual Review.

"If you write code without having AI involved in that process, you're probably doing it wrong." (Chad)What to Watchv3.21 adoption, the v3.21.1 cut expected next week, and the churn resuming ahead of the $XMR launch.Whether SwapKit scales its Rev-Share spending after v3.21, whether the return holds near 4.4x, and whether the share moves to 25%.Whether an ADR on ending LP rewards is written, and how many nodes join the vote.The 2-second block mimir, hoped for within the next month or two.The dynamic fee bracket search in v3.22, and Visual Review pages on every pull request.The quote-versus-fill test, once Kenton and Ray finalize the procedure.Kenton's quarterly report, which he hopes to work on this weekend.Chad at Zcon7, a possible technical Rujira session with Pragmatic Monkey or CodeHans, and Chad's planned appearance on Joel Valenzuela's show.Schedule changes: Zodl on Friday, October 23, and the Saturday show moving an hour later.More THORChain data, check out raynalytics.net

Follow Raynalytics for more Weekly Analytics and Podcast recaps.

THORChain is preparing to switch Rujira back on. The protocol’s v3.21 network upgrade is designed to patch the vulnerability that froze Rujira’s App Layer in late September. If node operators sign off, trading, lending and automated trading services are expected to resume.

The fix targets block height 28,366,100. That block is estimated to land on October 23, 2026, between 13:40 and 15:20 UTC.

What broke, and what gets fixed The problem sat inside the Rujira FIN contract, part of THORChain’s App Layer. An exploit detected on September 26 allowed unauthorized transfers of a concentrated liquidity position. That position belonged to the Rujira team.

The response came fast. On September 27, 2026, the App Layer was paused in coordination with THORChain node operators. No user funds were lost in the exploit, according to the findings.

The v3.21 upgrade is the patch. Once it activates and node operators approve, the halted Rujira products are set to come back online. The upgrade also restores support for SOL and ZEC trading, limit swaps and bRUNE staking.

The grace period gamble To address that, Rujira plans to request a conditional 24-hour liquidation grace period. It would apply to credit positions with a loan-to-value ratio above 100% that face liquidation when services resume.

An LTV above 100% means the loan is now worth more than the collateral backing it. Under normal rules, those positions would be first in line for liquidation the instant the system restarts.

The proposed window gives those borrowers a day to top up collateral or unwind positions. The word “conditional” is doing real work here. The grace period is a proposal that Rujira intends to put forward, not a guarantee.

Why the restart matters THORChain’s pitch has always been native cross-chain swaps without wrapped tokens. Rujira extends that idea into a fuller app layer with trading, lending and automated strategies built on top of the base protocol.

SOL and ZEC trading broadens the assets available on the platform. Limit swaps let traders set a target price instead of taking whatever the market offers. bRUNE staking gives RUNE holders another way to put tokens to work inside the ecosystem.

What this means for users and traders Borrowers are the group with the most at stake in the first hours. Anyone holding a position above 100% LTV should treat the restart window as a deadline, not a suggestion. If the grace period is approved, it buys time. If it isn’t, liquidations could hit as soon as services resume.

Rujira caught the exploit, paused within a day, avoided user losses and shipped a targeted fix.

Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.

THORChain’s gross swap fees are climbing again. They are also still 84% below where they stood in September.

That gap matters because September was not a normal month. Much of its activity came from funds tied to the Bitget exploit, and THORChain now has to show what its business looks like without that windfall.

The numbers behind the spike and the slide
September’s system income reached $3.01 million. In August, it was $615,000.

Swap volume followed the same path. It hit $2.40 billion in September, up from $613 million the month before.

Most of that jump happened in five days. Between September 25 and 29, flows connected to the Bitget exploit drove the activity.

Those exploit-related flows accounted for approximately 57-63% of September’s volume and income. That works out to around $1.37 billion in swap volume and roughly $1.9 million in income during the five-day window.

As of mid-October, gross swap fees have fallen to 84% below September levels.

Fees are recovering modestly, and they are hovering somewhere in the mid-to-high six figures. DefiLlama puts recent 30-day fees at approximately $635K.

That figure sits close to August’s $615,000 in system income. The comparison is loose, since the two metrics differ, but it points to the same story: once the exploit flows disappear, THORChain looks a lot like its pre-surge self.

No significant spikes or exploits were reported in October.

How THORChain fits into this
THORChain is a decentralized liquidity protocol built for swapping assets across different blockchains. A user can move value from one chain to another without routing through a centralized exchange.

A permissionless cross-chain swap venue works for everyone, including people moving the proceeds of an exploit. The protocol earns fees on that volume, which creates an uncomfortable dynamic. One of its best months recently was powered in large part by someone else’s bad week.

Not everything in September came down to the exploit. Ecosystem participation also grew during the month.

Active wallets rose to 25,000. The validator set expanded to 103 nodes.

Protocol-Owned Liquidity, or POL, had collected nearly 946,000 RUNE in deposits by September. POL is liquidity the protocol holds itself rather than borrowing it from outside providers. RUNE is THORChain’s native token.

A new way to split the revenue
THORChain has also changed how it distributes system income. The revised split works like this:

59% to nodes
20% to Protocol-Owned Liquidity
10% to TCY
5% to the Developer Fund
5% to the Marketing Fund
1% to RUNE burn

The RUNE burn share drops from 5% to 1%. The new model shifts that money toward other priorities, with the biggest change being the 20% now going to POL.

What this means
For anyone tracking THORChain as a business, the key task is separating signal from noise. September’s $3.01 million in system income makes for a great headline. However, approximately 57-63% of that month’s volume and income came from a single, nonrecurring event.

Strip that out, and the more useful benchmark is the roughly $635K in 30-day fees reported by DefiLlama.

Steering 20% of income into POL could give THORChain deeper liquidity it controls directly. The trade-off is the smaller burn, with the RUNE burn share falling from 5% to 1%.

The figures to watch are clear enough. Track whether monthly fees can climb meaningfully above the roughly $635K range without another one-off event. Watch whether active wallets hold near 25,000 now that the surge is over. Keep an eye on how quickly POL grows beyond its nearly 946,000 RUNE.

Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.

Tether has reversed restrictions on four THORChain vaults on TRON, restoring access to approximately $1.45 million in USDT for users after a freeze that lasted around three hours.

The brief restriction took place on October 9 and temporarily blocked access to USDT within affected vaults on the THORChain network, disrupting a cross-chain trading route relied upon by some traders and liquidity providers. The block did not result in any loss of funds, as vault balances remained fully intact after the freeze was lifted.

THORChain, a decentralized protocol enabling cross-chain swaps, had to pause TRON trading, deposit operations, and transaction signing due to the freeze. These activities resumed soon after Tether removed the relevant addresses from its blacklist, while 19 additional addresses targeted by the same restriction remain blocked.

Chad Barraford, technical co-founder of THORChain, explained that the team received no prior communication or explanation for the freeze. Barraford stated that the protocol directly reached out to Tether during the incident, seeking clarification and expressing hope that the situation was a misunderstanding.

Chad Barraford, technical co-founder of THORChain, said the project did not receive advance warning about the USDT freeze and immediately contacted Tether for clarity, describing the resolution as a return to normal operations without broader implications for the protocol’s liquidity.

The restored access applies to only those four THORChain vaults. Other addresses blacklisted in the same operation, which remain constrained, do not benefit from this reversal. Thus, the underlying mechanism enabling centrally issued stablecoins to restrict wallet use persists for the affected wallets.

For users, the primary impact was the short-term suspension of trading and liquidity services on the THORChain protocol. The restored balances once again became accessible, ensuring platform functionality for those utilizing the unfrozen vaults.

Mini dictionary: THORChain is a decentralized liquidity protocol that facilitates cross-chain exchanges of digital assets without intermediaries, allowing users to swap cryptocurrencies directly between different blockchains such as Bitcoin, Ethereum, and TRON.

Regulatory context and Tether’s wallet controlsTether, the issuer of the largest US dollar-pegged stablecoin in circulation, maintains control over USDT at the smart contract level. The company can freeze or unfreeze specific wallet addresses, typically in response to law enforcement requests or security incidents. In December 2023, Tether announced expanded freezing policies targeting wallets linked to sanctioned individuals or suspicious activity.

The operational pause on THORChain highlighted the dependency that even decentralized projects have on actions by entities controlling major stablecoin infrastructure. Decentralized exchanges or protocols must still account for the centralized authority embedded in these tokens, which can impact continuous access to liquidity or transactional capability if an address is blacklisted.

TRON’s rising USDT supply and market impactThe interruption and restoration of $1.45 million in USDT needs to be viewed within the broader context of the expanding USDT supply on the TRON network. According to data from research firm Lookonchain, the annual increase for USDT supply on TRON amounts to $18.67 billion, bringing the total to $94.25 billion—a growth rate of roughly 24.7%.

MetricValueUSDT released (THORChain vaults)$1.45 millionTotal USDT on TRON$94.25 billionAnnual USDT supply growth on TRON$18.67 billion (24.7%)Proportion of release vs. network supply0.0015%While the vault unfreeze helped restore protocol-specific activity, the sum involved represents only a fraction—around 0.0015%—of the overall USDT liquidity on TRON. Existing tokens held in the vaults did not constitute new issuance or net inflow to the stablecoin’s total supply. The event’s significance was largely operational for platform users.

The reopening of THORChain vaults did not indicate fresh capital entering the crypto market, but simply allowed already-issued USDT to become accessible for routine trading and liquidity provision.

The dominance of USDT compared to the broader cryptocurrency market temporarily retreated from a resistance zone noted in September. Still, market observers cautioned that this metric does not reliably predict flows into other cryptocurrencies, as total supply changes can result from a variety of user behaviors including transfers, collateralization, or platform migration.

At the time of the update, the remaining 19 addresses subject to the original restriction remained frozen, and neither Tether nor THORChain publicly disclosed further details regarding the criteria or communication behind the freeze.

THORChain has a fascinating history. It has processed an awful lot of ex-hack and ex-theft money over the years. The project lied about being decentralized for years. The leader could not appear more suspicious if he tried.

So when Bitget asked THORChain to block some addresses following an attack on Bitget and THORChain refused on technical grounds THORChain was not breaking new ground. What followed was an incredible interview with a so-called "expert" packed wall-to-wall with errors. And some technical commentary that made far more nuanced, less damning and far harder to adjudicate points. This measured commentary was also far less consequential in that the claims were not of any sort of grand illegality. They sat in stark contrast to the high profile interview riddled with problems. And most of the public chatter here is either unreasonably negative on THORChain but short on accuracy, or unreasonably positive on THORChain and also short on accuracy.

We are going to try to untangle this mess. The real story, in our view, has three essential plot points. First up: yes, THORChain was completely centralized and the team lied about this for years. Almost surely crimes were committed, even if only of the generic "unlicensed money transmission" flavour that nobody seems to care about anymore. We will sketch this a little bit below but, really, this is old news and not relevant to current activities. The team put themselves in a bad spot by lying for years.

Second: THORChain is not run by the best imaginable group of software engineers and their procedures and such look a bit sloppy. They also have a long history of security problems and some of the way they deal with their own shortcomings – they absolutely have a solid history of building defective software! – is less than ideal. This is a problem across web3 and in our view the THORChain team are no less competent than their self-described "expert" critics.

And third: the attacks on THORChain's current operation are mostly borne of ignorance, built atop falsehoods and misrepresentations, and fail to recognize that applying the same standards to other projects is to call many many large services outlaw. As we will see, if THORChain's current setup is outlaw then surely a large number of other large projects are too.

So here is a story of people that live in glass houses and seem to want to start a stone-throwing fight.

HistoryFor years THORChain had central admin keys that held pretty much arbitrary control over the platform. We published a relatively detailed technical piece in September 2024 working through much of this. To us this was old news at that time. Many of the code changes linked in that piece date to 2020 and 2021. All of that code was, and remains, public. The team lied in English about decentralization but the code was always out there.

We were not the only people to know about this of course. But it does look like nobody else ever bothered to publish an explanation that a half-technical person could actually follow.

Then in February 2025, shortly before the ByBit hack, THORChain announced it was removing these admin controls. That was an admission of sorts that they had always existed and that many accusations the platform was not decentralized were in fact correct.

Reasonable people can disagree over how long following this change it took for the admin controls to properly disappear. The THORChain network runs in epochs with governance processes that extend far longer than a single block. So this is not exactly like a Bitcoin change. And it is not even like a change to Ethereum staking or finality where 10s or 100s of blocks across minutes to maybe hours are sufficient to be sure the change has fully cleared. But this was initiated in February 2025 and was certainly well finished long before, many months before, 2026 began.

So none of the technical features of THORChain's centralized admin were relevant in September 2026. Claiming these things – which absolutely did exist for years – are relevant in a technical discussion of Bitget's request to THORChain is to admit you do not know what you are talking about. Do these prior bad acts maybe help establish a pattern of dishonesty? Sure. And it is reasonable to question if the team is lying now because the team was lying back then. But it is wrong to take proof of past lies as proof current statements are also untrue.

Current SetupTHORChain as of now is an odd system. It is sometimes accused of being a mixer. But it is not a mixer. It does not do a good job at obfuscating flows. Yes the recordkeeping is a bit messy and things could be more accessible. But all the transactions are visible and nothing like a mixer sits in the mix.

What THORChain actually provides is distance, not obfuscation. THORChain is effective for money laundering for two reasons. First, it allows transactions directly to Bitcoin where flows can then be mixed fairly easily. And second, large exchanges accept deposits from THORChain as clean in ways which frankly baffle us.

We discussed this in the New York Times in November 2025. A huge amount of ETH from the ByBit hack poured straight into THORChain. The hackers swapped to BTC and whoever they were trading with kept depositing those ETH to Binance. Presumably the hackers' trading counterparty was swapping those ETH back to BTC to reload THORChain. And round and round it went. It was easy to see this in real-time.

Binance accepted the ETH deposits from THORChain because...yeah we do not know why. As we told the New York Times "Even a bad — maybe even defective — screening tool would spot" that these were hack proceeds. But THORChain is a "legit" service and web3 does not have a problem with fund provenance from services with bad reputations so long as they are not actually mixers. Or at least that was the case in early 2025. Is it still true? We do not know. THORChain still is not a mixer but maybe some services will stop accepting inflows from there. Who knows.

Anyway, as of now THORChain is as decentralized as many other services. We will go through a bit of that shortly. But first it is worth looking at a few of the technical claims about the current setup that have been made to explore how false they are.

The Confused "Expert"First, we have an "expert" claiming THORChain is a closed-source permissioned project based on this chat excerpt:

https://x.com/tayvano_/status/2105515560935239710Important context here is that Dinosauruss is asserted to be an attacker that eventually joined THORChain as a node operator and successfully attacked the protocol. The chat transcript shows someone struggling to successfully join the network and asking for help on a Discord channel. This was interpreted as follows:

he was unable to churn in actually 😂 😂he tried for weeks and then he had to.......join the discordthats how you have his discord handle and id and know its himhe had to go into discord and share his addresses and info and beg to be let into the super secret room to get the real client codelmao lol hahahahhahahahaWe will take this line-by-line because it is important. The processing of "churn in" is how THORChain rotates node operators. Then we find a claim it took weeks to get the software working so they could churn in. And that they joined some Discord chats to ask for help and in fact some some help.

Finally, the claim is that this user was unable to join the network until they were allowed into a "super secret room" to get "the real client code."

If true that would be a problem. If you can only join a network by getting access to secret source code then it is not an open network. But this claim is not really true. Yes, THORChain has some odd embargo processes around security problems. But let's look at an actual release, v3.18.0, with code published May 9th, where the discussion above occurred just days before this release:

Given the dates this is the upcoming release discussed in the screenshot above.The release shipped as private binary, with the code to build the release made available at latest by May 9th and an expected production release date of May 12th. Does that mean only certain people could see the "security patches" while they were being developed? For at least some of the time yes it sure does. Does that mean less than 100% of development was done in the open? It sure does. But the code was released before production deployment. All code sits on the developers computer for some period of time before it hits the public. What matters is if the code is public before it gets put into production.

It is simply false that having some kind of security embargo policy renders your project closed-source. We need only present the Linux kernel Embargoed hardware issues policy to prove this beyond all doubt. If your definition of open source excludes Linux then your definition is wrong. So security embargoes and limited periods of non-public code development are accepted. This is not even a situation where the code was released post-deployment. Yes it was not available pre-deployment for as long as it could possibly have been available but that is a far cry from a process where one must "beg to be let into the super secret room to get the real client code."

Yes there is a little bit of complexity around the a library that does some of THORChain's internally developed cryptography. A small bit of code is, the team claims temporarily, not open source because it is security-critical and has had a lot of vulnerability problems. As discussed elsewhere in this column there are small closed-source components to many large web3 systems. And given the track record of bad security software development at THORChain the team does not have a lot of good options with respect to their vulnerable cryptography software. We view this as a minor mark against the team and anyway nothing worse than examples provided below. Once the team made the bad decision to roll their own cryptography the die was cast for problems in the general vicinity.

Now, if somebody wants to claim that web3 projects are only entitled to exemptions from various financial regulations when 100% of development is done in public they are certainly welcome to do so. But this is not only a bar far higher than that accepted by the software industry in general – it is a bar that will exclude nearly everything in web3 production use today. The expert we are addressing here works at MetaMask and as we have documented before parts of MetaMask are not open source and have been closed for years while used in production.

GoPlus's Soft Claimsweb3 security firm GoPlus published a piece claiming THORChain has never been strictly decentralized. The first clue this might be a weak argument is the use of "strictly." They did not even decide to lead with some clickbit but already took a soft position. We applaud GoPlus for being honest. And we also want to throw a little shade in their direction for making a noisy entrance without much real content.

The strictest definition of a decentralized protocol we can think of is that it is impossible for anyone to identify a sufficiently large group of participants such that it would be possible to compel the group to make changes to the protocol. In this "strict" sense Bitcoin is not decentralized because we can easily identify enough pool operators to pass 51% of the network and someone could, for example, visit their offices.

Would it be easy to force them to make some changes which are likely bad for Bitcoin? Who knows. But "strictly" can reasonably be interpreted to mean "can we get these changes put through if bring guns to a bunch of pool operators' offices and threaten to shoot them?" And then the answer is "yes." Now this would swap unlicensed money transmission for something a bit harder as the crime of interest but, again, GoPlus said "strictly." If "wrench attacks" are considered a reasonable threat model for securing self-custody then they are surely also a reasonable threat model for strict decentralization.

Most of GoPlus' specific complaints, numbered 2 through 5, all amount to "there is a smallish group that can collude to make arbitrary changes to THORChain." This is true and true of nearly every web3 project. We are not going to debate whether large mining pools render Bitcoin centralized – we are just going to say that using "strictly" as a weasel word here is a sign they know the argument is weak. Every product with a security council has this problem. In some sense everything with a multisig has this problem.

But GoPlus' first claim that "TSS vaults ≠ base-layer consensus" is worth discussing. THORChain uses a different architecture than many bridges and L2s and other things which connect blockchains to other blockchains. The Threshold Signature Scheme (TSS) used by THORChain is odd. Roughly speaking, funds within the THOR ecosystem sit within multisigs where some threshold of "validators" needs to approve outflows. GoPlus claims this is not the same as a "base layer consensus" scheme where the blockchain itself validates individual signatures and all you need to move assets is your own private key on top of a working blockchain. But validators sign blocks as produced, and blocks as produced include user transctions. Without block production transactions do not flow.

For an L1 there is a real difference in form here even if not in function. But for an L2 or a bridge or anything in that general area this is really no different than something like an odd sequencer design. A sole sequencer in an L2 is just a TSS where the threshold is the one sequencer. If you have some more distributed scheme then it is just a TSS where the T is however many parties need to approve a transaction or withdrawal. We will talk about Hyperliquid a bit below but suffice it to say Hyperliquid can be thought of as a dumb TSS too.

Now for an L1 or an L2 or a bridge is there a substantive difference between the validators having the collective ability to block or censor transactions vs a TSS where some quorum of validators need to actively approve (certain kinds of) transactions? If there is a difference it is small. But even acknowledging this is a legitimate question is to acknowledge Arbitrum, base, Hyperliquid, Polygon, Starknet and many many other projects are less decentralized than THORChain. Why? Because participating in the THORChain validation process is less gated than joining a security council or having a team-controlled emergency multisig.

Certainly THORChain is more decentralized than any of those things. There are complaints that THORChain's 100-ish nodes are really operated by only 10s of people. Maybe. Maybe not. Arbitrum froze funds using a 9-of-12 multisig. If your histrionic moaning does not even claim a T below 9 for the TSS yet you defend the Arbitrum action what are you even doing?

If anyone wants to take the position current THORChain is "clearly" an illegal custodial scheme they are arguing a huge swathe of web3 is also outlaw. We have a lot of sympathy for the last point there. A lot of the products named in the preceding paragraph, and others to boot, are in our view obviously illegal custodial schemes. And that can be true with current THORChain sitting on either side of the line. Be careful what you wish for.

ComparisonsThe best two comparisons here to show that current THORChain is not too bad are base and Hyperliquid. Is this a relativist argument? Yes. We are arguing that anyone that wants to paint current THORChain as completely beyond the pale must take the same position with respect to many other projects to reveal themselves to be a hypocrite. We expect the later to be the real explanation. But for now we will just focus on facts.

baseWe first wrote in August 2023 about base looking like a centralized, custodial system. We wrote a follow-up in July 2026 noting that essentially no progress had been made and the project's public comments over the interim 3 years admitted all our claims were true.

base's problem is that Coinbase controls all the levers and all the money. And Coinbase-controlled infrastructure not only holds all the funds in its sole custody and control, but Coinbase has actively rolled back the chain to address problems before and otherwise used its absolute central authority. Industry coverage generally acknowledges base is just a custodial service run by Coinbase with a bit of gratuitous software on top.

And the entire thing is built around a sole sequencer that needs to keep pushing out messages for bridging transactions to Ethereum to work. Yes, there are mechanisms to work around the Coinbase-operated infrastructure. But that infrastructure can also upgrade the code instantly at any time and take all the funds for itself if it wants. Coinbase has more power over base than the THORChain developers do over THORChain. It is not even close.

In THORChain the risk is the TSS does not give you your funds because the T is not met. In base the risk is that Coinbase decides it wants your money. Those are not identical but they sure are fairly similar. THORChain is, in our view, better.

HyperliquidThis one looks remarkably like THORChain only worse and more extreme. Hyperliquid takes the possible issues and oddities with THORChain and replaces them with clearly-out-of-bounds simplifications. To get your money off Hyperliquid one of the designated system validator addresses needs to approve your withdrawal through a two-step process. This is a TSS. And as discussed at that link it is a TSS gated by a permissioned set of validators.

And it gets much worse. THORChain may have some embargo issues and the processes for sharing code may not be ideal. But Hyperliquid is just straight-up closed source. There is no debate on this point: Hyperliquid's code is not available to the public.

THORChain also has some kind of strange on-chain governance processes where parameters can be changed and votes are taken and the like. We are not going to get too deeply into the details here because what really matters for the comparison is that Hyperliquid's on-chain governance is supposed to be mediated by a dispute resolution process. But that process is restricted to the team itself and approved participants. So external parties simply cannot participate at all. Again, THORChain's wonky and not-perfect schemes are clearly more open than Hyperliquid's smoke filled back room. The schemes are not even close.

One of the core complaints about THORChain quoted above, once corrected for clear errors and false statements, is that it is awfully difficult for external parties to follow along and participate because the code is often released with little notice and the system is fiddly to run. Those are real gripes and fair enough. But they are qualitatively different from a system that simply does not allow external participation at all and does not publish source code at all.

DiscussionTHORChain has a long history of misrepresenting how it works and processing funds straight out of hacks and thefts. THORChain has a lot issues. The THORChain team almost surely has open legal liability.

But that does not mean every complaint about THORChain today is accurate or reasonable. And it certainly does not mean current THORChain is a particularly outlaw product. This is not an effort to defend THORChain or apologize for past bad deeds by the team. It is just being honest about what is happening today. Does doing better today excuse past bad conduct? Not really. But again, it is only fair to attack the team for what they actually did not what you dreamed up they are still doing.

When compared against a lot of major, respected, services today current THORChain looks pretty good. This is maybe 50% because THORChain has improved a lot and 50% because a huge fraction of current services are also misrepresenting the degree to which they remain outlaw. Maybe that should be 60/40 or 20/80 or some other mix. Maybe you view the mix differently. But there is clearly a large measure of both components at play here.

Today THORChain and the team behind the project are in kind of a tough spot because of their past behaviour. Admitting you did lots of crimes before but changed the system as a way of defending against allegations you are criming today...that has obvious problems as a defense strategy.

But we really do not see that they have any choice. THORChain's best course of action is to compare the functionality of the system today and in the past to other more-respected systems with similar problems. There are only two ways the THORChain team avoids law enforcement: staying below the radar or looking like they were doing the best they could and hoping the high level plan is not to arrest everybody. If the plan is to arrest everybody they are already screwed. And staying below the radar screen has not been a viable strategy for some time. Our advice to the THORChain team is based on the simple premise that you must play the cards you are dealt.

So honestly and openly describing how THORChain is of a piece with many other web3 products out there is just about all they can do. We hope they make an effort in this direction primarily because – full disclosure here – it will be very amusing to watch people squirm. Will this likely involve making statements about illegal behaviour by other large projects which are generally considered to be good actors? Yes it will. Is that good for "web3" as a whole? Who knows. But the rest of the ecosystem brought this on themselves by accepting funds out of THORChain when it was clearly an outlaw service and then turning around and unfairly attacking it for things it did not do. Game on then it would seem.

George Town, , October 8, 2026 —, Cayman Islands, October 8th, 2026, Chainwire

THORChain, a decentralized exchange, announced that native Zcash (ZEC) swaps are now live, allowing users to exchange ZEC with assets across other supported blockchain networks without relying on wrapped tokens or a centralized exchange.

The launch follows THORChain update 3.20, which introduced support for Zcash and Monero to the protocol. The Zcash pool currently holds more than $50,000 in liquidity, allowing the network to begin processing live ZEC swaps.

The pool remains in a soft-launch phase while performance is monitored. Trading may be temporarily paused if bugs or other issues need to be addressed. The current pool size can easily support trades in the five-figure range, however larger trades will experience higher slippage and take longer to settle until liquidity grows in the pool.

Protocol-Owned Liquidity (POL) will be automatically added to the Zcash pool when the fees/depth ratio is high enough. POL, introduced as part of the 3.20 upgrade, gives the protocol a mechanism to deploy a portion of the liquidity fees (currently set at 20%) into supported liquidity pools. As more liquidity enters the ZEC pool, it will be better equipped to support larger swaps with lower price impact and faster execution.

The integration gives Zcash holders a direct route into the broader crypto market using native assets. Users can swap ZEC against supported assets including Bitcoin (BTC), Ethereum (ETH), and stablecoins without needing to deposit their Zcash with a centralized custodian or convert it into a wrapped representation on another network.

Zcash adds another native blockchain to THORChain’s cross-chain liquidity network, bringing the total to 14 blockchains. Rather than move assets through bridges or require users to give up custody to trade between otherwise disconnected networks, THORChain settles swaps using the native assets on their respective chains.

The soft launch will allow the network to test Zcash swaps under real market conditions while liquidity develops. The Zcash pool and its current liquidity can be tracked here.

About THORChain THORChain is a decentralized exchange (DEX) that enables users to swap native digital assets across different blockchain networks without relying on wrapped assets or centralized custodians. It allows users to exchange assets including Bitcoin, Ethereum, and other supported cryptocurrencies while maintaining a self-custodial experience.

Users can swap assets here: swap.thorchain.org

Swap | Website | X | Telegram | LinkedIn

THORChain could have taken steps to disrupt funds linked to the Bitget hack, according to co-founder Chad Barraford. However, he said implementing an effective response would have been difficult, as coordinating validators can take days while attackers can quickly move funds to new addresses.

Barraford discussed the issue during an Unchained interview hosted by Laura Shin alongside onchain analyst and investigator Taylor Monahan. The debate centered on whether THORChain could have done more after Bitget asked the protocol to stop serving addresses linked to wallets that drained $387.5 million from the exchange.

Barraford said THORChain does not currently have a mechanism that allows the protocol to immediately censor individual transactions or wallets. He said creating one would still leave validators with the problem of coordinating quickly enough to act before stolen funds move elsewhere.

Reaching the two thirds validator consensus needed for certain actions takes about three days on average and can sometimes take as long as two weeks, Barraford said. A faster response, he argued, would require redesigning THORChain to give a smaller group more control.

The problem becomes more complicated once transactions are already underway.

Barraford said halting trading with swaps in progress would require reallocating those funds through a vault migration, which itself needs two thirds consensus and could take one to two weeks.

Validators could theoretically block a known Ethereum address before its funds entered the protocol, he added, but the attacker could simply switch to another address and continue trading.

“You can’t have the fast enough response because the protocol is decentralized,” Barraford said.

The discussion nevertheless showed that THORChain was not entirely without options.

Shin pointed to existing functions capable of halting Ethereum or Bitcoin trading. She argued that the Ethereum halt function could have sent certain swaps associated with stolen funds back to their sender rather than allowing them to continue through the protocol.

She also highlighted THORChain’s MakePause function, which she said allows a single node to temporarily halt chains for 720 blocks, or roughly an hour, potentially giving validators time to discuss a response.

Barraford’s argument was not that THORChain can never stop trading. Instead, he argued that using those mechanisms against an active hacker creates practical problems because a broad halt affects legitimate users while validators coordinate a more permanent response.

That coordination is easier when THORChain itself is under threat.

Barraford said validators tend to quickly reach consensus when an exploit threatens the protocol because protecting THORChain is part of their responsibility.

“When there’s a bug or an exploit on ThorChain, there is a wide consensus immediately amongst all validators that we need to pause trading,” he said.

Monahan challenged that distinction by pointing to previous instances in which THORChain had been willing to interrupt its own operations.

She cited the ThorFi incident, when an admin key was used as an interim measure to pause lending before validators approved further action through consensus. Barraford stressed that the key itself could only change configuration and could not directly reallocate user funds.

Shin also compared the situation with the response to the DAO hacker years earlier.

She said ShapeShift repeatedly reacted as the hacker attempted to convert stolen funds into Bitcoin. Although the attacker could continue switching addresses, Shin argued that responding still made moving the funds harder and appeared to cause the hacker to give up at certain points.

Barraford responded that ShapeShift was centralized at the time, allowing it to react far more quickly than a validator driven protocol such as THORChain.

Taylor Monahan pushed the broader argument that THORChain’s inability to perfectly stop stolen funds should not prevent validators from trying to make laundering more difficult.

She argued that the protocol had mechanisms available to intervene and questioned the use of decentralization as a justification for taking no action when a large share of activity on a route consisted of stolen funds.

The same disagreement had already surfaced following the Bybit hack.

Barraford said some THORChain validators attempted to pause Ethereum trading when stolen Bybit funds moved through the protocol, but the effort failed because most validators opposed the action.

“A few did it, but the vast majority didn’t want to do that,” Barraford said.

He later said roughly 20 validators may have left around the disagreement, although he stressed that he did not remember the exact number and said the network has since added more operators.

The previous vote illustrates the distinction at the center of the Bitget debate. THORChain validators can attempt to interrupt trading, but doing so does not guarantee that enough operators will agree or that they can coordinate before an attacker moves the funds.

Later in the interview, Barraford acknowledged more directly that validator consensus could ultimately be used to block laundering.

Asked by Shin what would happen if enough node operators joined THORChain and supported censoring illicit transactions, Barraford replied, “Then laundering would be blocked.”

“If you get a two third majority agreeing that we should censor transactions, then sure, that would be the way of the community,” he said.

Shin also raised NEAR Intents as an example of a protocol taking a more active approach.

She said the project’s Shield risk layer can refuse quotes or halt swaps during execution and had blocked an attempted $50 million in laundering. According to Shin, the system also froze roughly $500,000 during a swap and planned to return $340,000.

Asked whether THORChain could introduce something similar, Barraford said it was technically possible if validators supported it.

“Maybe. If the nodes want to deploy something like that, it’s up for validators to determine,” Barraford said.

“If the nodes wanted to do that, they could. My guess is they wouldn’t, but I don’t speak for them.”

The exchange ultimately narrowed the dispute from whether THORChain can intervene at all to how quickly and effectively it could do so.

The protocol has mechanisms capable of interrupting trading, and validators could adopt stronger controls through consensus. Barraford’s position, however, is that coordinating those measures quickly enough to stop an active hacker is difficult under THORChain’s current design.

He summarized that governance limitation later in the interview by acknowledging that validator consensus can ultimately change the protocol.

“Yes, if you get consensus behind any change, you could change anything,” Barraford said.

Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.

THORChain has a large amount of data available onchain, but understanding what that data means is not always easy.

boone.tools was created to solve that problem. The site brings together a growing collection of dashboards covering THORChain’s pools, Protocol-Owned Liquidity, node votes, the App Layer, network economics, and several other parts of the protocol.

The goal of this is to make the state of THORChain easier to understand so that the people participating in the network can make better-informed decisions.

Why Boone Built boone.toolsBoone is a long-time THORChain community member and contributor who has become increasingly involved in the protocol's development. He has contributed to discussions about THORChain's economic model, including advocating for Protocol-Owned Liquidity and the removal of block rewards. More recently, he has been working on THORChain's Monero integration, developing the core proof of concept for connecting Monero to the network.

His motivation for creating boone.tools came from a simple problem. Whenever he wanted to investigate something about THORChain or verify a particular claim, he often struggled to find the necessary information in one place. Instead of repeatedly collecting the same data, he started building tools that could track it automatically.

As Boone explained during our interview, "I either want to know something or I want to show someone else something." This curiosity has been the driving force behind boone.tools, with each dashboard addressing a specific question about the protocol.

Interestingly, Boone never intended to build an entire analytics platform. It started when he experimented with building a dashboard to track THORChain's newly introduced Rapid Swaps feature. After sharing it with the community, people began requesting additional tools, and the project gradually developed into a much larger collection of dashboards.

Even the name came about organically. Boone drew inspiration from the existing community analytics platform rune.tools, which had made its source code publicly available. He used that project as inspiration for his own dashboards and named his platform boone.tools as a playful reference to rune.tools.

Today, boone.tools helps community members better understand THORChain by providing direct access to information about the network's activity and economics. This is especially valuable for a decentralised protocol where Nodes are responsible for making important decisions about how the network operates.

By making this information more accessible, Boone hopes to give community members a shared factual basis for discussions about THORChain's future. While participants may disagree about which direction the protocol should take, they can use the underlying blockchain data to better understand its current state and make more informed decisions.

Explore THORChain Through boone.toolsboone.tools has gradually developed into a collection of 16 specialised dashboards, each designed to help users understand a different part of THORChain.

The dashboards range from Status, Rapid Swaps, Pool Analysis and Financials to tools tracking Protocol-Owned Liquidity, RUNE burns, Node bonds, vaults, the Treasury, dynamic fees, governance and App Layer activity. Other dashboards include TC Fee Dash, Pool Dislocation, POL TVL, POL Tracker, Burn Tracker, Bond Tracker, Vault Explorer, ADR26 Dynamic Fees, Vote Tracker, App Layer / Base Layer, and Briefings.

Together, they provide a much more detailed view of what is happening across THORChain, from network health and swap activity to liquidity, protocol finances and governance.

Covering all 16 tools in detail would quickly become overwhelming, so we asked Boone which metrics he considers most useful when analysing THORChain. He highlighted the following five metrics that he considers to be the most important.

1. Pool AnalysisThe Pool Analysis dashboard gives users a detailed look at how THORChain's individual liquidity pools are performing. Boone originally built it because he wanted to understand which assets were responsible for generating the protocol's trading volume and revenue. Although this information was available through different sources, there was no single place where he could easily compare the performance of individual pools.

For each pool, users can compare its internal price with an external oracle price, see its liquidity depth, and examine the underlying asset and RUNE balances. The dashboard also tracks trading volume and liquidity fees across different periods. Users can sort pools by these metrics to identify which assets are generating the most activity and revenue.

One of the most useful metrics is fees relative to pool depth, which Boone considers an important indicator of capital efficiency. It shows how much fee activity each pool generates relative to the liquidity available. This information has become particularly relevant with the introduction of Protocol-Owned Liquidity (POL), as the protocol uses fee generation relative to liquidity depth as part of its process for determining where additional liquidity should be allocated.

Users can also select individual pools to examine their historical performance. The dashboard provides charts showing daily trading volume, daily fees, cumulative fees, and changes in pool depth over time.

Bitcoin PoolThese historical comparisons make it possible to identify how liquidity and trading activity develop within individual pools. For example, users can examine whether a pool has attracted additional liquidity or whether its capital efficiency has improved over time.

As Boone explained during our interview, Pool Analysis is one of the dashboards he checks most frequently himself. It gives him a straightforward way to understand which assets are generating revenue and how efficiently THORChain's liquidity is being used.

2. POL TrackerThe POL Tracker focuses on THORChain's Protocol-Owned Liquidity and how the protocol builds and manages its own positions in liquidity pools.

Boone has been one of the strongest advocates for POL within the THORChain community. He believes that allowing the protocol to build its own liquidity addresses several important problems, including its historical dependence on the independently managed Treasury to provide liquidity for new and existing pools.

As Boone explained during our interview, POL allows THORChain to build a liquidity base that it controls itself. This reduces its reliance on external liquidity providers and gives the protocol a mechanism for directing additional capital toward pools that need it.

The POL Tracker provides the data needed to follow this development. Boone considers the current value locked in POL its most important metric. Alongside this figure, the dashboard displays how much RUNE has been deposited through the mechanism and how that capital has been allocated across individual pools.

Users can examine POL's positions, its ownership share within individual pools, and how deposits have developed over time. Another important metric estimates POL's share of the liquidity fees generated by the pools in which it participates. However, Boone emphasised that this figure requires some interpretation.

Simply attributing fees according to POL's ownership share does not necessarily mean that POL was responsible for generating those fees. Some swaps would have taken place regardless of whether the protocol had provided additional liquidity.

The purpose of this calculation is therefore to illustrate POL's potential contribution to THORChain's economics. By providing deeper liquidity, POL can improve swap execution and potentially attract additional trading activity. This creates the possibility of generating more revenue that can subsequently be reinvested into liquidity.

The dashboard also includes a metric that treats RUNE deployed through POL as effectively removed from circulation. Boone emphasised that this is not a conventional token burn. The RUNE remains within liquidity pools, and its balance can change as market prices fluctuate.

Together, these metrics allow users to follow how POL develops and evaluate its potential contribution to THORChain's liquidity and long-term economic sustainability.

3. Cross-Chain CompetitorsThe Cross-Chain Competitors dashboard compares THORChain's economics with competing cross-chain trading systems, including Chainflip and NEAR Intents. Boone developed this comparison because he believes that trading volume alone provides an incomplete picture of how successfully a protocol is performing.

A protocol can generate significant trading activity while spending substantial amounts on token incentives to attract users and liquidity. Consequently, higher trading volume does not necessarily translate into a stronger economic model. To account for this, Boone's dashboard compares the protocols using a straightforward calculation: profitability = fees − token emissions.

This distinction is especially important when comparing THORChain with NEAR Intents. Although NEAR Intents has periodically generated substantially more trading volume, Boone argues that its economic performance looks very different once token emissions are taken into account. THORChain, meanwhile, operates with virtually no ongoing token emissions, allowing it to retain considerably more of its income under this methodology.

During our interview, Boone explained that his dashboard has generally shown THORChain generating substantially more net income than its competitors. The comparison helps illustrate why trading volume alone is insufficient to evaluate the economic sustainability of different cross-chain protocols.

It is important to recognise that this calculation does not represent each protocol's complete operating profit. Instead, it provides a consistent framework for comparing swap-related income against token subsidies, helping users understand which protocols generate revenue without relying heavily on continued token issuance.

4. Vote TrackerThe Vote Tracker makes THORChain's onchain governance activity more accessible by providing a detailed overview of Node voting.

THORChain Nodes use Mimir votes to change many of the parameters that determine how the network operates. These include economic settings, transaction fees, chain configurations, and operational parameters.

Before developing the dashboard, Boone found that understanding ongoing votes and their current status could be unnecessarily difficult. Although some information was available through Discord and existing tools like rune.tools he wanted to provide a more detailed overview that allowed users to examine voting activity directly.

The Vote Tracker provides three main views. The first organises voting activity by parameter, showing which Nodes have voted, their proposed values, and how many additional votes are needed for a change to take effect. Users can also examine historical votes and see when parameters were actually updated, such as when Nodes voted to enable or disable Bitcoin trading.

The second view focuses on individual Nodes, allowing users to examine their voting history and average response times. This is particularly useful for bond providers who want to understand how actively Nodes participate in governance and whether their decisions align with their own preferences.

Finally, the dashboard provides a searchable overview of THORChain's current Mimir values and network constants, giving users easy access to the network's operating parameters.

5. App Layer / Base LayerThe App Layer / Base Layer dashboard tracks how economic activity generated by the Rujira App Layer contributes to THORChain's underlying network. It provides an overview of how funds move between the two layers and displays the cumulative value transferred to the Base Layer.

The dashboard distinguishes between two sources of revenue. The first consists of fees generated when App Layer transactions use THORChain's Base Layer infrastructure, which contribute to System Income. The second consists of revenue generated directly by App Layer applications and subsequently shared with THORChain's Protocol Reserve.

As Boone explained during our interview, these revenue streams are distributed differently, making it important to track them separately. The dashboard also distinguishes between revenue generated and funds actually transferred to the Base Layer, as some revenue accumulates in a contract before being distributed gradually over time.

Finally, the dashboard tracks funds allocated to App Layer POL, which operates separately from THORChain's Base Layer POL mechanism. Together, these metrics give users a clearer understanding of how App Layer activity generates revenue, how that revenue is distributed, and how much economic value ultimately reaches different parts of THORChain.

A Better Way to Understand THORChainboone.tools makes it easier to understand what is happening across THORChain without having to piece together information from different sources.

The dashboards give users a clearer view of how the network is performing and how different parts of the protocol are developing over time. This is especially useful for a decentralised network like THORChain, where many important decisions are made by Node Operators.

Better access to this information will not mean everyone agrees on what THORChain should do next. It does, however, give the community a stronger basis for those discussions and makes it easier to make decisions based on what is actually happening onchain.

Explore boone.tools at https://boone.tools .

TLDR THORChain activated Zcash (ZEC) pool support on October 2 following a complete node churn across its network. Every active validator now tracks the Zcash blockchain, though native swaps have not yet been enabled. The team cautioned that pool depth remains limited in these initial stages and recommended trader vigilance. Integration required months of technical work including UTXO management, RPC implementation and oracle integration for ZEC pricing. The rollout occurs while THORChain faces questions about its handling of assets connected to the Bitget security breach. THORChain has activated support for its Zcash liquidity pool. The deployment was confirmed on October 2 after the protocol finalized a comprehensive node rotation.

The $ZEC pool is now live on THORChain.

The network churned and every node is watching the Zcash chain. @Zcash now has a truly permissionless venue.

Trading is the next step. Liquidity is shallow for now and will grow over time, so trade with caution in the early days. pic.twitter.com/sVEj0K4xNQ

— THORChain (@THORChain) October 2, 2026

All operational validators across THORChain’s network are now actively observing the Zcash blockchain. While trading functionality remains offline, the protocol indicated it represents the immediate next milestone.

In its public statement, THORChain made clear that swap activity is forthcoming. The pool deployment and the activation of user-facing trades are distinct implementation phases.

Pool Depth Limited During Initial Phase THORChain issued guidance to users regarding the current state of the newly deployed pool. The protocol acknowledged that available liquidity is currently limited and will expand gradually.

Users were encouraged to exercise care during the initial period of ZEC operations. The October 2 announcement did not include specific figures for pool capacity or a confirmed timeline for enabling trades.

A network monitoring interface displaying THORChain’s active validators now shows ZEC operating with normal status. It is listed among Bitcoin, Ethereum and other integrated blockchains.

Extended Technical Work Preceded Launch The Zcash integration represents the culmination of significant development efforts. A March 4 protocol enhancement introduced chain-specific UTXO management and RPC functionality tailored for ZEC.

That identical upgrade integrated Zcash into the protocol’s oracle infrastructure. This enabled the network to conduct native price discovery for the asset.

A subsequent GitLab patch resolved a complication with ZEC network fee calculations. Engineers noted that an earlier implementation could artificially increase gas tolerance parameters during specific solvency checks.

Development activity extended through September. A THORNode code merge corrected signing discrepancies that emerged when validators computed transaction expiration from varying local chain states.

The solution anchored transaction expiration to a consensus ZEC block height. This approach ensured signing consistency across all validators during retry attempts and system restarts.

On September 17, THORChain confirmed that Zcash would be the next blockchain integrated into production. This followed an interval during which the project prioritized network reliability over expanding chain support.

Zcash’s UTXO architecture demanded additional configuration efforts. THORChain required parameters for address verification, gas calculations, minimum output thresholds, block intervals and coinbase rules before deployment could proceed.

The pool activation coincides with heightened scrutiny of THORChain’s involvement in processing compromised assets. Bitget revealed a security incident beginning September 24, subsequently increasing the estimated value transferred to attacker wallets to approximately $387.5 million.

Bitget indicated the figure encompassed Zcash and Tron transactions identified by forensic analysts. The platform enumerated affected tokens including XRP, ETH, USDT, ZEC, USDC, XAUt, BNB, AVAX and TRX.

Investigation findings suggest a wallet associated with the Bitget perpetrator executed 27 exchanges via THORChain. These transactions converted approximately 2,390 ETH into 75.2 BTC, valued at roughly $6.3 million at execution.

Bitget had requested that THORChain prevent transactions originating from addresses linked to the attacker. THORChain refused, explaining that its emergency mechanisms can halt a blockchain or the entire protocol but lack the capability to isolate individual addresses or transactions.

THORChain articulated its stance in an October 1 blog entry. The project stated that substantial protocol modifications demand a two-thirds supermajority among validator operators.

This marks not the first occasion THORChain has encountered such examination. Following the February 2025 Bybit compromise, Bybit’s CEO stated that 72% of approximately $900 million in laundered stolen assets transited through THORChain.

Bitget’s asset recovery portal currently displays attacker wallet addresses spanning multiple networks, including Zcash. The exchange has posted a 5% reward for assistance resulting in asset freezing or recovery.

At present, THORChain’s Zcash pool is operational, though native swap functionality has not been activated.

NEAR Intents said it blocked more than $50 million in attempted transfers linked to the Bitget hack. 

Attackers stole $387.5 million from Bitget on Thursday. A significant portion of these funds moved across chains to Ethereum, according to Alex Shevchenko, general manager of NEAR Intents, a protocol that lets users swap crypto assets across blockchains. 

Shevchenko said its SHIELD system detected and blocked more than $50 million in attempted transfers, which subsequently went to other providers. It managed to freeze $503,000 in funds during execution, while around $166,000 in suspected stolen funds passed through.

The post came as THORChain faced calls to block addresses linked to the attack, underscoring a tension that permissionless crypto protocols face — offering open access while seeking to curb illicit activity. 

Shevchenko argued that permissionless systems do not necessarily have to be neutral. “The people who build these systems make choices about what those protocols enable. Refusing to help launder stolen assets is one of ours,” Shevchenko said.

“Property rights are fundamental to functioning markets. A financial system where stealing an asset gives you an unrestricted right to monetize it isn’t a freer system. It is simply a system that protects the thief. Such systems cannot become the economic backbone of the future,” he added.

NEAR Intents said it will forego the 5% bounty offered by Bitget for freezing attacker funds and an additional 5% for their recovery, allowing more funds to be returned to Bitget. Shevchenko said the frozen funds would be returned through an appropriate legal process. 

The move comes after Circle and Tether blacklisted a wallet linked to the Bitget exploiter on Friday, freezing $318,013 of USDt (USDT) and USDC (USDC), according to onchain data.

Source: Bitget CEO Gracy Chen on Friday also called on THORChain, a decentralized protocol for swapping assets between blockchains, to refuse services to addresses linked to the attack. 

THORChain, however, said it doesn’t censor by design, and that while it has halted the network in the past, this is an emergency security mechanism that affects the protocol broadly and “is not a selective freeze of specific funds or an individual swap.” 

Shevchenko said NEAR Intents would actively fight the laundering of hacked funds. 

“Crypto cannot simultaneously demand recognition of digital property rights and build infrastructure optimized for monetizing stolen property,” he said.

Magazine: Asia dominates Crypto Adoption Index, Bitget’s $352M hack: Asia Express

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Some assets linked to the Bitget security breach have entered Wasabi CoinJoin after moving through several blockchains and swap routes, according to blockchain compliance firm AMLBot.

Summary

AMLBot traced roughly four BTC linked to Bitget theft into a Wasabi CoinJoin transaction round. Funds moved from TRON through USDT0, Ethereum and THORChain before reaching Bitcoin addresses for mixing. Bitget now confirms approximately $387.5 million was transferred to attacker-controlled addresses during the September breach. About $343 million remained dormant across thirteen attacker wallets as of September 25, AMLBot estimated. Bitget plans phased withdrawals from September 28 after identifying and fixing the underlying security vulnerability. AMLBot said on Sept. 27 that its tracing connected roughly 4 BTC in one CoinJoin round to funds originating from a Bitget-linked TRON wallet. The firm described the activity as an apparent attempt to obscure the movement of stolen assets.

The finding comes after Bitget revised the value of assets transferred to attacker-controlled addresses to approximately $387.5 million. The exchange’s official investigation update said the new total includes Zcash and TRON assets that were missing from its initial $351.6 million estimate.

Bitget funds moved through four networks before CoinJoin AMLBot traced a multi-stage route beginning on TRON. According to the firm’s account, the attacker first converted TRX into USDT. The funds were then moved to Ethereum through USDT0, an omnichain version of Tether designed for transfers between supported networks.

Once on Ethereum, the assets were swapped into approximately 145 ETH. AMLBot said the ETH subsequently moved through THORChain and was converted into around 4.59 BTC.

The Bitcoin was then divided into smaller amounts before reaching a Wasabi CoinJoin round. AMLBot said its analysis could connect roughly 4 BTC in that transaction back to the Bitget TRON wallet.

CoinJoin combines Bitcoin inputs and outputs from multiple participants in a single transaction. The technique can make transaction tracing more difficult because blockchain observers cannot simply map one input to one corresponding output.

AMLBot characterized the activity as laundering through Wasabi CoinJoin and said it had blacklisted the linked addresses. The company is continuing to monitor the Bitcoin for further CoinJoin activity.

The attribution remains AMLBot’s blockchain analysis. Public blockchain records show transfers between addresses, swaps and cross-chain activity, but the purpose of each transaction is inferred from the observed flow and address attribution.

A Binance News summary published Sept. 27 repeated the same sequence, citing reports based on AMLBot’s tracing.

Bitget raises confirmed loss to $387.5 million Bitget initially said the Sept. 24 incident affected approximately $351.6 million in assets after unauthorized transfers from portions of its hot and warm wallet infrastructure.

The exchange detected the activity at 18:31 UTC and suspended withdrawals while leaving deposits and trading operational. Cold wallets remained secure, according to Bitget’s initial security notice.

By Sept. 25, Bitget’s transaction classification had raised the confirmed amount to approximately $387.5 million. The exchange said the increase did not result from new thefts after the breach. Investigators had instead identified additional Zcash and TRON assets involved in the original incident.

Affected assets included ETH, XRP, USDT, USDC, USDT0, ZEC, XAUt, BNB, AVAX and TRX. Bitget published primary attacker-controlled addresses on Ethereum-compatible networks, XRP Ledger, Zcash and TRON as part of its recovery work.

Bitget’s preliminary findings pointed toward a compromise involving backend wallet infrastructure rather than a leak of private keys. CEO Gracy Chen said private keys remained secure while investigators worked to identify the exact intrusion path.

Bitget later said its security team had identified the attack path and the method used to bypass existing controls. The company said the underlying vulnerability had been fixed, though it has not publicly released a complete technical root-cause report detailing the exploit.

AMLBot says most stolen assets remain dormant The CoinJoin activity represents only a small part of the funds linked to the breach.

In a Sept. 25 update, AMLBot said approximately $343 million, representing around 88% of the roughly $389 million it was tracking, had not moved. The firm’s figure was based on addresses it had attributed to the attacker.

AMLBot identified 13 dormant wallets holding several asset types. Eight Ethereum wallets contained approximately 68,300 ETH, while four XRP addresses held around 83 million XRP. Another wallet contained close to 18,900 ZEC.

The firm said none of those 13 addresses had sent a transaction since receiving the funds. Its subsequent Wasabi update concerns a different portion of the stolen assets that had already begun moving between chains and assets.

Other researchers have traced separate conversion activity. Crypto.news reported on Sept. 25 that security researcher Taylor Monahan identified stolen USDC being moved and converted into ETH after the attack.

Her findings showed attacker-controlled assets being bridged and swapped after leaving Bitget. The report noted that Circle can freeze USDC at specified addresses when legal requirements are met, though the public transaction trail did not establish whether a qualifying legal order had reached Circle at the time.

The subsequent AMLBot tracing shows another part of the flow crossing from TRON to Ethereum and then into Bitcoin through THORChain before entering CoinJoin.

Bitget prepares phased withdrawal reopening Bitget is preparing to restore withdrawal services after saying the vulnerability responsible for the incident has been remediated.

The exchange’s withdrawal schedule starts with Bitcoin at 08:00 UTC on Sept. 28. ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism are scheduled for Sept. 29.

USDT withdrawals on Ethereum, BSC, Solana and TRON are scheduled to resume on Sept. 30. Other token withdrawals, fiat services and peer-to-peer withdrawals are expected to return on Oct. 2.

Bitget said Mandiant and SlowMist continue to assist with the security investigation while its technical teams perform validation work on the withdrawal infrastructure.

As crypto.news reported on the reopening plan, Bitget says its Protection Fund will cover the financial loss from the incident and customer account balances remain unchanged. The exchange reported that the fund held more than $464 million during the withdrawal pause.

Bitget’s September proof-of-reserves update, published before the breach, showed a total reserve ratio of 135% across 19 covered assets. The exchange states that it maintains at least a 1:1 reserve ratio for user assets covered by the program. CEO Gracy Chen is scheduled to host a live AMA at 07:30 UTC on Sept. 28 covering the incident, restoration of withdrawals and the exchange’s next steps.

The Bitget hack has sparked a new debate over crypto’s biggest promise of decentralization. After hackers routed stolen funds through THORChain and converted assets into Bitcoin, Bitget CEO Gracy Chen asked the protocol to block the attacker addresses. 

THORChain rejected the request, saying its permissionless design does not allow it to censor transactions.

How Did the Bitget Hacker Use THORChain?Following the 24 September 2026 Bitget breach, blockchain security firms TRM Labs and SlowMist’s MistTrack tracked how the stolen funds moved across different networks.

According to blockchain tracking firms, the hackers first swapped stolen USDT and USDC into ETH and BNB to avoid freezes by issuers such as Tether and Circle.

Yet, Circle and Tether managed to freeze 218,023 USDT and 99,990 USDC, worth about $318,000 combined, from an attacker linked address.

Over the next 13 hours, the attackers moved millions of dollars in ETH and BNB through THORChain, a cross-chain protocol that allows direct swaps between different blockchains without using wrapped tokens. This allowed hackers to convert part of the stolen funds into native Bitcoin (BTC).

The newly converted BTC was then spread across thousands of private wallets, making the funds harder to track and recover.

Until now, hackers have moved about $4 million–$4.5 million of the stolen $387.5 million through THORChain and converted it into Bitcoin.

THORChain Rejects Bitget’s RequestThe movement triggered a public clash between Bitget and THORChain.

Bitget CEO Gracy Chen called on THORChain validators to block addresses linked to the attackers. Chen argued that decentralization should not prevent networks from responding to known stolen funds.

Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses. Decentralization is a design principle, not a shield for facilitating known stolen funds.
The industry is watching. https://t.co/rOzV9kpu0F

— Gracy Chen @Bitget (@GracyBitget) September 26, 2026 THORChain rejected the request, saying it is a decentralized, permissionless network similar in design to Bitcoin and Ethereum. The protocol said blocking selected transactions would go against how its system operates.

“What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?”

THORChain Faces Criticism Over Its RoleThe THORChain team’s response has drawn criticism from crypto security experts. SlowMist founder Cosine pointed to THORChain’s handling of earlier incidents and questioned whether the network should take action when stolen funds are clearly identified.

The decision has drawn criticism from security experts, including SlowMist founder Cosine, who questioned THORChain’s response to funds linked to major hacks.

After the $1.46 billion Bybit hack, nearly $1.2 billion in stolen funds reportedly moved through THORChain. Now, funds linked to the Bitget hack are also being sent through the network for swaps.

The attacker wallets have already been flagged and are being tracked by exchanges and security firms. Critics say this raises questions about whether THORChain could do more to stop the funds.

They also point to past incidents when THORChain developers used a “red button” to pause the network during an exploit.

when thorchain got drained in 2021, the network halted within hours. when thorfi went underwater in jan 2025, nodes voted to freeze withdrawals overnight.
"decentralized and permissionless" seems to apply only when it's other people's money.
a sanctioned state already used you to… https://t.co/V3PXFB5PCG

— Matt (@matthubuilds) September 27, 2026 Critics argue that the network is now continuing to process stolen funds and collect fees from these transactions.

Story Ends Here

Trust with CoinPedia:CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.

Investment Disclaimer:All opinions and insights shared represent the author's own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.

Sponsored and Advertisements:Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.

Read the Next News

Attackers drained roughly 11.7 million XRP from thousands of D’CENT App Wallet users. The theft, worth close to $20 million, unfolded between September 15 and 20. XRPL.to published the on-chain forensic timeline.

The operation unfolded across six separate waves. It hit a combined 6,678 wallets using keys the thief already controlled.

How the Attack Actually UnfoldedSomeone manually drained eight wallets, each holding over 99,999 XRP, within an hour on September 15. An automated script then swept a total of 1,682 wallets that same day.

Five more waves followed through September 20. Each wave reused the same script, manual tool, and stolen keys.

Attackers went beyond simple transfers, too. They deleted 5,001 accounts entirely to claim their remaining reserve balances, XRPL.to reported.

Notably, 2,470 of those wallets had never been swept. That detail suggests the thief held a broader list of compromised keys than the initial drain revealed.

Follow us on X to get the latest news as it happens.

Wallets swept per hour (up) and accounts deleted per hour (down). Source: xrpl.toThe stolen funds moved fast. Roughly 5.6 million XRP crossed into Ethereum through THORChain. Other funds are routed through exchanges, including Binance, as well as services like unionchain.ai and NEAR Intents.

Each sweep often reached an off-ramp within hours, limiting the window available for freezing stolen funds. About 1.3 million XRP still sat in the attacker’s own wallets as of September 21.

Why Are D’CENT Users Specifically at Risk?D’CENT confirmed abnormal transfers affecting its App Wallet on September 16. The company clarified that hardware wallets remained unaffected. It later urged users to move funds immediately, though it has not confirmed whether reimbursement will follow.

Notably, no XRP Ledger exploit caused this incident. Every sweep used valid signatures from the wallets’ own private keys. That detail means the compromise originated from how those keys were exposed, not from any flaw in the network itself.

5.6 Million XRP Moved to Ethereum Through THORChain. Source: xrpl.toXRPL.to’s analysis found the operation reused identical scripts and fee patterns across multiple waves. That pattern strongly suggests a single coordinated actor carried out every stage. Security researchers now recommend one specific step.

Anyone who used D’CENT’s App Wallet at any point should migrate funds to a new wallet immediately. The exact method behind the original key compromise still remains unconfirmed.

XRP trades near $1.49 at the time of writing. That figure marked a 6% drop over the past 24 hours, according to BeInCrypto data. The token’s market cap stood near $93.82 billion, ranking fifth among all cryptocurrencies.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights.

THORSday Community Podcast #235 ft. CBarraford, KentonC137 & patriotsounds | September 17, 2026 | Watch the full episode on YouTube

By Raynalytics

TL;DRTHORChain's stability sprint has ended. The team has resumed normal operations, with an oversolvency sweep, affiliate-fee experiments, and new chain launches back on the near-term agenda.Zcash is next in line for mainnet, with Monero planned as a fast follow. The team stressed that timing remains conditional, and that $XMR will begin with a deliberately cautious soft launch.Dynamic fees for Symbiosis, a proposed SwapKit rev-share test, and a privacy-routing integration from Houdini Swap are all intended to test whether more protocol revenue can fund operations without a larger Dev Fund.Chad's priority is not adding headcount. It is reaching a point where protocol revenue reliably pays for maintenance, security, and development without depending on treasury support or token inflation.1. The Stability Sprint Is OverThe episode opened with the clearest operational update in weeks: the developer teams agreed to end the stability sprint and return to normal operations. That does not mean the recent work has been forgotten. The point of the sprint was to make the protocol more consistent after the exploit-related disruption, and Chad said the current churn was moving funds after a keygen that succeeded quickly.

Chad Barraford described the next immediate action as enabling the oversolvency sweeper, which will move assets from over-solvent pools into the treasury. He also separated protocol work from external-chain issues, noting that a new Solana transaction type and Gaia nodes falling behind their chain tip had created recent interruptions outside THORChain's core code.

"The sprint is over. We're back to normal operation." (Chad)The practical meaning is a return to shipping, but with the stability work informing the pace. The team still wants predictable churns, reliable external-chain observation, and a safer base before treating the next rollout as business as usual.

2. Zcash First, Then a Careful $XMR LaunchThe immediate chain-client sequence is Zcash first, then Monero. Chad said the ordering reflects the existing queue rather than a technical rule. Either chain could technically go first, or both could launch together, but the working plan was to finish Zcash and then focus on $XMR.

That is a meaningful change from the earlier stability-first posture, not a promised date. Chad said the $XMR code is already in place, but enabling it requires coordination from node operators. Kenton added that the team expects to give roughly three days' notice before asking nodes to apply the change that enables $XMR by default, ideally just after a churn so operators have the maximum window before the next one.

"We want to do a soft launch. It's technically live, but ... don't trade in size." (Kenton)The proposed soft launch is important context. The goal is to create awareness and invite early use without presenting a new chain client as fully seasoned on day one. The team expects a ramp period of several weeks, even if the integration reaches mainnet on schedule.

For background on why the rollout was delayed, see THORChain Prioritizes Stability Before Monero and New Features.

3. More Revenue Tests Are Back on the TableSeveral experiments paused by the sprint are now moving again. Chad said the dynamic-fee model was due to be re-enabled for Symbiosis after the aggregator resolved a routing issue. He also named Gem Wallet and Edge Wallet as potential next participants, while a rev-share experiment for SwapKit was targeted for the following week, subject to operational readiness.

These are distinct levers. Dynamic fees aim to find a partner- and pair-specific fee floor that protects price-sensitive flow without giving away revenue from users who would route through THORChain anyway. Rev-share would let an approved affiliate share in some protocol liquidity fees. The test matters more than the announced date because it will show whether the mechanism works with real routed volume.

Kenton also outlined the intended integration of Houdini Swap into THORChain Swap: a private-swap option first, followed by a private-send option once it is ready. He described it as a new revenue opportunity, but the discussion kept the status clear. It was planned, not live at the time of the episode.

"We'll flip it on, give it a few weeks, and see what happens." (Chad)The team has reasons to be interested without treating them as results. Chad cited Symbiosis's reported $300 million to $500 million in trailing-30-day trade volume as flow THORChain would like to win a greater share of. Kenton said Houdini's own partner data suggested a potentially meaningful contribution to treasury income. Both are hypotheses to test, not guaranteed revenue.

4. Self-Sufficiency Comes Before a Bigger Dev FundThe longest strategic discussion was not about a new feature. It was about what success should look like after those features begin producing revenue. Chad said THORChain was operating at a monthly shortfall of roughly $100,000 to $200,000, covered by the treasury. Increasing the Dev Fund from 5% to 10% would reduce that reliance, but he did not see it as a reason to immediately hire more developers.

Instead, the stated objective is for protocol revenue to cover the people and services that keep THORChain operating. In that model, an oversolvency sweep, new integration revenue, and higher organic swap activity would first reduce the treasury's operating burden. Only then would the community face a stronger question about whether to spend the surplus on a larger team, reserves, or other priorities.

"I'd rather have the money become less reliant on the treasury than go ahead and hire one or two or three more devs." (Chad)That framing also explains the team's caution on hiring. Chad said developers are already finding ways to become more productive with AI tools, while the treasury is being managed for longevity rather than the spending profile of a venture-backed startup. A larger team remains possible, but only if the economics support it without recreating the dependency the protocol is trying to leave behind.

5. More Capacity Does Not Mean Every Idea Ships NowReturning to normal operations does not mean every queued idea has the same priority. Chad described separate groups working on maintenance, new chains and features, and continuous security work. That lets the security team continue an audit and work on initiatives such as DKLS and FROST while other developers focus on integrations and day-to-day protocol reliability.

Some ideas remain intentionally deferred. An opt-in chain-client model could eventually let smaller chains be validated by a subset of nodes, making it easier to support assets that cannot justify the full validator set. Chad said the concept was actively explored, but paused in favor of higher-value work such as Zcash, $XMR, $TAO, dynamic fees, and rev-share. He did not expect it to return this year.

The same discipline applies to chain removal. When the group asked whether Gaia should be removed, Chad's answer was economic rather than ideological: a chain that brings useful volume and revenue has a reason to remain. In the future, opt-in validation could allow participation to decline naturally rather than forcing every chain question into an all-or-nothing governance decision.

"We shouldn't Ragnarok any chain when that chain is profitable." (Chad)What to WatchWhether Zcash reaches mainnet cleanly, and whether the team announces the $XMR node-change window that precedes its cautious soft launch.The live results from Symbiosis dynamic fees, the proposed SwapKit rev-share test, and the planned Houdini integration.Whether new revenue sources and the oversolvency sweep reduce the treasury's operating burden before any Dev Fund change is considered.Whether the resumed churn continues to bring standby node operators into the active set without recreating the instability that prompted the sprint.More THORChain data, check out raynalytics.net

Follow Raynalytics for more Weekly Analytics and Podcast recaps.

According to EmberCN’s monitoring, a whale who previously offloaded 50,600 ETH at an average price of $2,921 at the end of last year, locking in around $19.02 million in profits, has re-entered the market to buy BTC after staying inactive for roughly 8 months. The whale has recently conducted continuous cross-chain swaps via THORChain, spending a total of $85.42 million in USDC over 4 days to acquire 1,075.6 BTC at an average cost of around $79,412, including approximately $170,000 in swap fees paid to THORChain. Around September 9 alone, the address bought 179.8 BTC using $14.2 million in USDC within 24 hours, at an average transaction price of roughly $78,955.

Relevant content

Analysis: Bitcoin sentiment indicator hits a two-year high, market frenzy is cooling down.

CryptoQuant analyst Darkfost stated that Bitcoin’s recent rally has lifted investor sentiment to its strongest level since March 2024. The market sentiment metric he tracked once surged above 89/100, entering the "extreme greed" territory. This indicator integrates multiple data points including the Fear & Greed Index, with a scale spanning -100 to +100, where -100 corresponds to extreme fear and +100 to extreme greed. Darkfost pointed out that extremely bullish or bearish market sentiment typically signals a potential trend inflection point. Currently, as prior market euphoria gradually recedes, the sentiment metric is cooling to a more normal level, while Bitcoin continues to struggle to defend its current price range.

22 minutes ago

Micron issues a generous maximum bonus of up to 68 months' salary; the labor union in Taiwan, China still threatens to strike.

Micron Technology announced it will distribute record 2026 fiscal year bonuses to its employees in Taiwan, China, with some staff receiving bonuses equivalent to up to 68 months of salary, and the minimum cash compensation reaching 1.7 million New Taiwan Dollars (approximately $53,800). Entry-level engineers are set to receive an average total bonus of around 3.4 million New Taiwan Dollars, plus annual equity grants. However, the Taoyuan Union, which represents roughly two-thirds of Micron’s workforce in Taiwan, China, still rejects the current plan, insisting that 15% of the company’s operating profit be allocated to employee bonuses. The union added that it will proceed with strike procedures if Micron does not respond to its demands. Micron currently employs about 15,000 people in Taiwan, China, with cumulative investments exceeding 1.6 trillion New Taiwan Dollars. The increased bonus payouts are widely viewed as tied to the profit-sharing mechanisms of South Korean memory chip makers. This year, Samsung Electronics, under pressure from union strikes, ultimately agreed to establish a special bonus pool equal to 10.5% of its semiconductor division’s operating profit. As labor negotiations between Micron and its staff in Taiwan, China enter a critical phase, a potential full-scale strike could disrupt Micron’s production schedule and further roil the global memory chip supply.

22 minutes ago

Dell surges 12% in a single day to reach an all-time high, as Oracle named it a core supplier for its $95 billion AI spending.

Oracle management explicitly stated during its earnings call that its fiscal 2027 capital expenditure (capex) of $90 billion to $95 billion will be focused on expanding AI data centers, naming suppliers including Dell and HPE. Boosted by this news, Dell Technologies’ U.S. stock surged 11.98% on Friday, hitting a record high, with its market capitalization exceeding $360 billion, bringing its year-to-date gain to nearly 350%. Oracle previously disclosed that its fiscal 2027 capex will increase significantly, primarily for purchasing AI server racks, liquid cooling systems, and networking equipment. Meanwhile, the company’s AI cloud orders continue to grow, further boosting visibility for Dell’s future AI server orders. RBC Capital initiated coverage on Dell and assigned it an "Outperform" rating, noting the company will continue to benefit from the multi-year AI infrastructure investment cycle, and highlighting its supply chain capabilities as a competitive moat. Dell currently has over 6,500 AI server customers; its AI server revenue hit $16.4 billion in the second quarter, up 100% year-over-year, with AI server backlog reaching $95 billion at the end of the quarter. As cloud providers like Oracle continue to ramp up AI infrastructure investments, Dell is emerging as a key beneficiary of the current AI capex expansion cycle.

22 minutes ago

As oil prices top $100, the BRICS Summit has centered on Iran, yet divisions among its members have deepened.

The BRICS Leaders' Summit was held in New Delhi, India. As the ongoing conflict involving Iran continues to disrupt the Strait of Hormuz and Red Sea, and international oil prices have topped $100, Iran emerged as one of the core topics at this year's summit. Member states including China, Russia and India have direct communication channels with Iran, a diplomatic advantage the U.S. currently lacks. Iranian President Masoud Pezeshkian called on member states ahead of the summit to establish alternative financial instruments to reduce reliance on the Western-led financial system, and criticized the U.S.-dominated global order. Russian President Vladimir Putin, meanwhile, advocated for advancing the establishment of a BRICS platform more independent from Western rules, with a focus on strengthening cooperation in payments, investment, technology and infrastructure. However, it will not be easy for BRICS to position itself as a mediator in the Middle East crisis. Iran is on opposing sides of a conflict with the United Arab Emirates (UAE), another BRICS member, which has previously suspended trade and financial exchanges with Iran; India, meanwhile, must balance its relations with the U.S., Gulf states, Russia and Iran. Divergences among member states previously led to the foreign ministers' meeting failing to issue a joint statement. What the market is currently more focused on is whether BRICS can reach a minimal consensus on energy security, cross-border payments and the Middle East situation. With ongoing disruptions to shipping in the Strait of Hormuz, whether the summit can ultimately deliver a unified stance will also serve as an important window for observing global energy and geopolitical trends.

22 minutes ago

Viewpoint: The Federal Reserve’s interest rate hikes are fundamentally unnecessary, and the overall economy is stable.

Liz Miller, founder and president of U.S. wealth management firm Summit Place Financial Advisors, said that while markets widely expect the Federal Reserve to raise interest rates next week, further policy tightening is "fundamentally unnecessary" given the overall economic stability. Miller noted, "I think most investors believe the Fed will raise rates next week, and I also think that’s highly probable. But it’s fundamentally unnecessary. I’d be interested to hear the discussions at the policy meeting, as some Fed officials firmly believe action is needed before overall inflation picks up to push it back to the 2% target. However, if we take a patient view of other parts of the economy, they are actually performing quite stably. I’m not sure a broad rate hike is truly necessary. We can continue to monitor whether rising oil prices will spill over and watch core inflation gradually fall."

22 minutes ago

ZachXBT: Revolut Suspected of Leaking Data of Some High-Net-Worth Users Due to Trusting a Forged Government Request

On his personal channel, blockchain investigator ZachXBT stated that fintech firm Revolut allegedly failed to detect a forged government agency request, leading to the leakage of some users’ personal identifiable information (PII). According to his disclosure, Revolut received a customer information retrieval request that appeared to come from a legitimate government agency, sent via the agency’s official email domain. Since the email had valid domain authentication details, Revolut deemed the request authentic and responded. The potentially involved data includes users’ names, dates of birth, occupations, addresses, emails, phone numbers, as well as copies of passports or driver’s licenses, identity verification selfies, account statements, IBANs, withdrawal records, and full transaction histories—including Bitcoin transactions. In its notification to users, Revolut said no biometric facial telemetry data was leaked. ZachXBT noted that the incident’s scale may be limited, but it appears to target primarily high-net-worth users. Multiple Revolut users received alerts about the security incident yesterday. Revolut officials have previously reminded users to verify suspicious communications via in-app customer service and avoid providing personal or financial information.

22 minutes ago

The hacker behind the third wave of Coldcard hardware wallet exploits has started cashing out, routing approximately 97.09 BTC, worth about $7.8 million, through cross-chain swaps and mixing services over a five-day window. Galaxy Research flagged the movement on September 7, noting it represents roughly 45% of the Wave 3 stolen funds.

The funds first hit THORChain on September 2, where they were swapped into Ether. By September 5 and 6, additional portions had been run through CoinJoin transactions, a Bitcoin privacy technique that bundles multiple users’ transactions together to obscure the trail. The attacker appears to be working through the largest vaults first, a prioritization strategy that suggests deliberate planning rather than panicked liquidation.

A firmware flaw five years in the making A firmware update shipped by Coinkite in March 2021 (version 4.0.1 onward) introduced a bug that caused Coldcard devices, primarily the Mk3 and later models, to default to a software-based pseudo-random number generator when creating wallet seeds. The hardware random number generator was effectively bypassed.

Advertisement

The result: seeds generated with only 40 to 72 bits of effective entropy. For context, modern cryptographic standards typically call for 128 to 256 bits. Skilled attackers could reconstruct private keys entirely offline through brute-force computation.

Coinkite eventually patched the firmware, but any wallet seed generated during the vulnerable window remains compromised regardless of whether the device itself has been updated. The company has urged affected users to generate entirely new seeds and migrate their funds.

The full scope: 1,789 BTC across 8,865 addresses Galaxy Research, led by analyst Alex Thorn, has been tracking the Coldcard exploit chain since the attacks began on July 30, 2026. Total confirmed losses stand at approximately 1,789 BTC, valued at around $114.7 million at the time of theft. More than 8,865 addresses have been affected, with the median victim losing more than 1 BTC. An additional cluster of 58 addresses has been identified that could push total losses to roughly 1,806 BTC.

The attacks came in waves. The first wave alone extracted 1,082.65 BTC in just 41 minutes, a staggering pace that points to automated scripts scanning the blockchain for weak keys. Galaxy’s research suggests at least 15 different attackers were involved across the waves, which ran from July 30 through August 6. Activity dropped sharply after that.

Of the total haul, 82% of stolen Bitcoin remains sitting in attacker-controlled wallets. Only 18% has shown movement consistent with laundering. Galaxy’s team has engaged directly with over 190 victims and shared identified attacker addresses with law enforcement agencies and industry partners.

THORChain’s uncomfortable spotlight The attacker’s choice of THORChain as a laundering vehicle is notable but not surprising. The decentralized cross-chain liquidity protocol enables swaps between native assets on different blockchains without requiring a centralized intermediary. THORChain’s permissionless architecture means it can’t freeze or reverse transactions the way a centralized exchange can.

The subsequent use of CoinJoin adds another layer of obfuscation. By mixing the converted funds with legitimate Bitcoin transactions, the attacker makes chain analysis significantly harder, though not impossible. Firms like Chainalysis and Elliptic have developed increasingly sophisticated tools for de-mixing CoinJoin outputs, and law enforcement has successfully traced CoinJoin-laundered funds in prior cases.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.

Galaxy Digital Head of Research Alex Thorn stated that attackers behind the Coldcard Wave 3 recently transferred stolen funds for the first time, converting a portion of the assets to ETH via cross-chain decentralized exchange THORChain. This marks the first instance of funds from the Wave 1, Wave 2, or Wave 3 attacks being moved from the attackers’ initial wallet addresses to other on-chain addresses. Currently, approximately 90% of the stolen funds from Wave 3 remain untransferred. On-chain activity indicates the attackers encountered apparent issues when conducting conversions via THORChain, with some transactions being repeatedly refunded, though they continue to attempt converting the remaining funds.

Relevant content

The Crypto Fear & Greed Index has risen to 65, with the market remaining in "greed" territory.

According to data from Alternative, today’s Crypto Fear & Greed Index dropped to 65, up from 63 yesterday, with market sentiment remaining in the "Greed" territory. Note: The index ranges from 0 to 100, and its components include: volatility (25%), trading volume (25%), social media buzz (15%), market surveys (15%), Bitcoin’s market dominance (10%), and Google Trends analysis (10%).

10 minutes ago

Chasing the rally of the 'NiuLai' token, crypto KOL XXAntiWar transfers 17.57 million tokens to seven addresses.

According to on-chain analyst Ai Yi (@ai_9684xtpa), crypto KOL XXAntiWar, who chased the rally during the bull market, has transferred 17.57 million tokens to 7 addresses via multiple intermediaries in recent days, and is currently still in unrealized loss. Thus, while Fomo shows XXAntiWar has liquidated all positions, this is actually because new holding addresses have not been recorded.

10 minutes ago

An institution transferred 39,500 ETH worth approximately $95 million to a CEX.

According to Yuqing Monitoring, an institutional entity transferred 39,500 ETH (valued at approximately $95 million) to multiple CEXs over the past day. Over the past four days, its total transfers to CEXs have reached 142,800 ETH (worth around $345 million), while it still holds 29,735 ETH (approximately $70.9 million).

10 minutes ago

South Korea’s foreign exchange reserves posted a record increase of $14.33 billion in August.

South Korea’s foreign exchange reserves rose by $14.33 billion in August, marking the largest single-month increase in history, driven mainly by a sharp rise in commercial banks’ foreign currency deposits at the Bank of Korea (BOK). The BOK said in a Thursday statement that as of the end of August, the country’s foreign exchange reserves climbed to $442.28 billion from $427.95 billion at the end of July. The central bank added that August’s reserve growth stemmed primarily from a surge in foreign currency deposits held by financial institutions, while a weaker U.S. dollar against other currencies also boosted investment income and valuation gains on overseas assets denominated in foreign currencies. The improved reserves have strengthened South Korea’s financial buffer, as the won weakened several times in the first half of the year, drawing market attention to the country’s external financing conditions. Earlier this year, the won fell to its lowest level since 2009, prompting South Korean authorities to repeatedly warn against excessive exchange rate volatility and seek to curb capital outflows driven by massive retail investor investments in overseas assets.

10 minutes ago

Berkshire Hathaway plans to hold stakes in Japan's five major trading houses for the long term, with related stocks rising collectively.

Japanese trading house stocks rose on Thursday after Greg Abel, CEO of Berkshire Hathaway, said the firm plans to keep its stakes in these trading houses for decades to come. The trading house sector was among the top gainers in the Topix index on Thursday. Mitsubishi Corp. jumped as much as 4.5%, hitting its highest level since May; Sumitomo Corp., Mitsui & Co., Itochu Corp., and Marubeni all rose more than 2.5%. Berkshire currently holds roughly a 10% stake in each of the five trading houses. Abel, who took over as CEO from Warren Buffett in January this year, told CNBC in an interview on Wednesday that Berkshire’s holdings in the Japanese trading houses are "long-term investments" and the company intends to hold them for decades. Since Berkshire disclosed its stakes in 2020, the share prices of these Japanese trading houses have benefited from their association with Buffett. A market analyst at Tokai Tokyo Research Institute noted that Abel’s renewed show of confidence "may rekindle investors’ interest in buying trading house stocks."

10 minutes ago

Ansem: Robinhood’s Stock Price Bottoming Out and Consolidating, Expected to Hit New High in Q4

Crypto KOL Ansem wrote in a post that traditional finance (TradFi) firms consistently lag behind when integrating new crypto operations, as their suited executives often take too long to access relevant data. He believes Robinhood (HOOD) is a strong investment pick, noting its stock has been consolidating from the bottom, while the company is adding a key new revenue stream through its Layer 2 blockchain business. Robinhood’s stock is projected to hit a new all-time high in the fourth quarter, rising 50% from its current level.

10 minutes ago

THORChain x Rujira Podcast #230 ft. PragmaticMonkey, KentonC137 & patriotsounds | August 29, 2026 | Watch the full episode on YouTube

By Raynalytics

TL;DRRujira's app layer was globally paused while THORChain's base-layer team investigates non-determinism concerns. Pragmatic Monkey argued that the known risky contract could have remained paused while other app-layer activity resumed, but Kenton stressed that the full technical picture was still emerging.The dispute was not only about uptime. A global pause leaves users unable to manage positions and removes the app layer from price dislocations that can generate revenue for Rujira and THORChain.Pragmatic Monkey said a prior restart produced more than $500,000 in volume and about $18,000 of revenue in a few blocks. Those are his internal figures from a prior event, not a forecast for the next restart.The episode's shared conclusion was straightforward: stability takes priority, but emergency decisions need a clearer communication and coordination process.Custom Concentrated Liquidity is live. Dynamic Concentrated Liquidity is being tested, while Sonar remains a possible future mobile product rather than a committed launch.IntroductionTwo days after THORChain's stability-first update, a separate problem came into view: Rujira's app layer was not merely slowing new work, it was globally paused.

Pragmatic Monkey joined Kenton and Denny to explain why Rujira contributors were frustrated. The immediate question was technical, but the bigger question was operational: when a decentralized network needs an emergency control, who communicates the scope, the rationale and the path back online?

1. The App Layer Is Paused While the Base Layer StabilizesPragmatic Monkey said the chain had encountered several non-determinism issues, the kind that can cause nodes to disagree about the state of the network. One app-layer yield contract was the observed trigger when it was enabled. The base layer had returned after the contract was paused, he said, but the wider app layer remained halted.

His position was not that stability should be sacrificed for activity. Rujira's team supports the broader decision to slow releases and focus on making the base layer robust. The disagreement was over scope. Pragmatic Monkey said the affected contract had already been isolated successfully, so a contract-level pause could let other app-layer positions and strategies operate while the investigation continued.

"We own this system together." (Pragmatic Monkey)Kenton did not present the case as settled. He said he did not have all the technical information and pointed to the possibility of further concerns that justified testing before a restart. That distinction matters. The episode records Rujira's argument for a narrower pause, not a confirmed finding that a global pause was unnecessary.

For users, however, the difference is tangible. A global halt can leave collateralized positions inaccessible while markets move. Current positions were described as standard CDPs rather than perps, which lowers but does not remove liquidation risk. The same control model would be much harder to defend once high-leverage products exist.

2. Decentralization Needs an Emergency ProcessThe episode became a live governance discussion. Pragmatic Monkey said Rujira had no warning that the full app layer would remain paused when the base layer restarted. Kenton agreed that communication needed to improve, while also resisting a judgment before the contributing developers had explained their reasoning.

"Real decentralization should not mean no coordination." (Pragmatic Monkey)The network's ability to halt a contract or the app layer is a strength in a genuine emergency. The problem is making that power predictable for users, builders and node operators. Rujira's proposed minimum is not centralized control. It is an agreed process: identify the risk, use the narrowest safe scope, tell affected teams and users what happened, and state the conditions for reopening.

Kenton framed the tension with an emergency-brake analogy. A brake belongs on the train, but it should be pulled for an emergency, not as an ordinary operating decision. The practical follow-up is to determine whether the available evidence required a global halt and to make the next decision easier to understand in real time.

"We have to find some chain of command or some procedure or something like that that we can all agree to." (Kenton)This is also a reminder of how THORChain governance works. Node operators can coordinate a different outcome when the necessary threshold is reached. That is decentralized control, but it does not eliminate the need for shared norms around safety-critical actions.

3. A Restart Can Be an Economic EventThe cost of the pause is not limited to unavailable positions. Rujira's architecture can capture price differences between its app-layer markets and THORChain's base-layer pools. When those markets restart out of sync, the resulting dislocations can create arbitrage opportunities that flow through the protocol instead of entirely to external traders.

Pragmatic Monkey showed a prior restart in which, he said, Rujira processed more than $500,000 of volume and generated roughly $18,000 in revenue in a few blocks. He said nearly all of that revenue came from arbitrage, despite total app-layer TVL remaining below $2 million at the time. Under Rujira's 50/50 revenue split, he estimated about $9,000 went to THORChain from that event.

"We made $18,000 of revenue in just a few blocks." (Pragmatic Monkey)Those figures describe a prior event with its own market conditions, not an estimate for a future restart. But they explain Rujira's urgency. A wide price gap can be an opportunity to internalize value for liquidity providers and the protocol. Keeping the app layer closed means that opportunity is instead left to whatever external arbitrage can access the base-layer markets.

The same argument has limits. A restart must not be rushed merely to capture revenue. The point is that an app-layer pause changes market access and economic outcomes, so its scope and duration deserve the same transparent treatment as its security rationale.

4. CCL Is Live. DCL and Sonar Remain Work in ProgressThe original plan for the show was a demonstration of Custom Concentrated Liquidity, or CCL. That product is live and lets users provide liquidity within a chosen range. A broader walkthrough is being rescheduled.

The next product, Dynamic Concentrated Liquidity, or DCL, is earlier. As covered in the Podcast #223 recap, DCL is designed to move beyond a fixed range. Pragmatic Monkey said the new strategy would use an oracle price and a user's average entry price, buying only when it lowers that average and selling above it at a target spread.

That does not make DCL live. The first contract version was only days into testing, and Pragmatic Monkey was still examining how it behaves in a sustained one-way market. A strategy that protects an average entry price can also go long periods without trading, which is good for capital preservation but less useful for steady market making and protocol volume.

"More stability, more robustness, and then we can move on to actually try to continue building the cool apps." (Pragmatic Monkey)The group also discussed Sonar, a future Rujira mobile product. It is not an active release. Rujira's immediate priority is improving its web and mobile-web experience, while a rebuilt mobile app remains a possibility when capacity permits.

What to WatchThe app-layer restart: what the base-layer and Maya teams conclude about broader non-determinism risk, and whether the app layer can return with the affected contract still paused.Emergency coordination: whether contributors establish a clearer process for scoped halts, communication and restart conditions.User-position safeguards: how the pause model evolves before higher-risk products such as perps are introduced.Restart economics: whether a future synchronized restart again creates internalized arbitrage revenue, and how that value is distributed.DCL testing: whether the strategy can balance average-entry protection with enough activity to be useful for market making.Sonar: whether mobile-web improvements lead to a formal plan for a Rujira mobile app.More THORChain data, check out raynalytics.net

Follow Raynalytics for more Weekly Analytics and Podcast recaps.

George Town, Cayman Islands, 25th August 2026, ChainwireBy Chainwire

2 min read

Create an account to save your articles.

Add on Google

Add Decrypt as your preferred source to see more of our stories on Google.

George Town, Cayman Islands, August 25th, 2026, Chainwire

THORChain, a decentralized exchange, announced the launch of THORChain 3.20, an upgrade introducing native support for Monero (XMR) and Zcash (ZEC) swaps.

Until now, moving between privacy coins such as XMR or ZEC and the crypto market has required users to rely on centralized exchanges, custodial services, or additional intermediary steps. With THORChain 3.20, users can natively swap XMR and ZEC against assets including Bitcoin (BTC), Ethereum (ETH), and stablecoins directly through THORChain.

No wrapped versions of XMR or ZEC are required. Users do not need to create an account or hand custody of their assets to a centralized entity. This is a significantly more direct route between privacy-focused cryptocurrencies and the most widely used assets in crypto.

For Monero holders, access to the broader crypto market has become an increasingly important issue as XMR continues to be removed or restricted by centralized exchanges. THORChain’s integration provides an alternative based on native assets and self-custody rather than requiring users to deposit their coins with an exchange.

The release is one of THORChain’s most significant upgrades to date. In addition to Monero and Zcash integration, version 3.20 introduces several broader changes to the protocol, including Protocol-Owned Liquidity (POL) and the new Stable Reserve, alongside renewed support for Solana, Base, and BNB. The Stable Reserve introduces stablecoin-to-stablecoin swaps with no liquidity fees, and Protocol-Owned Liquidity gives THORChain additional mechanisms for deploying protocol capital across the network.

The move builds on THORChain’s core proposition of allowing users to exchange native cryptocurrencies across otherwise disconnected blockchain networks without handing control of their assets to an intermediary.

THORChain already enables native cross-chain swaps across assets including Bitcoin and Ethereum. The addition of privacy-focused networks expands that model into an area of the crypto market where decentralized access has been far more limited until today.

About THORChain

THORChain is a decentralized exchange that enables users to swap native digital assets across different blockchain networks without relying on wrapped assets or centralized custodians. It allows users to exchange assets including Bitcoin, Ethereum, and other supported cryptocurrencies while maintaining a self-custodial experience.

Users can swap assets here: swap.thorchain.org

Swap | Website | X | Telegram | LinkedIn

ContactTHORChain Community
[email protected]

Disclaimer: Press release sponsored by our commercial partners.

Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.

THORSday Community Podcast #229 ft. CBarraford, KentonC137 & patriotsounds | August 27, 2026 | Watch the full episode on YouTube

By Raynalytics

TL;DRTHORChain has put new launches on an initial one-to-two-week pause to prioritize stability after v3.20 and the pending v3.20.1 hotfix. Zcash, $XMR, protocol-owned liquidity deployment and the SwapKit rev-share test are all delayed, not cancelled.The team traced the immediate instability to app-layer calls through non-deterministic API endpoints. A temporary app-layer pause remains technically possible, but no decision to use it was made during the episode.ADR30 was at 38% approval when recorded. It would let node operators delegate selected administrative commands without handing over control of funds.THORChain is considering what an AI-native protocol interface should look like. An unpublicized MCP server already exists in GitLab, while a command-line wallet for agents is only a possible direction.Memoless registrations were paused after a spam attempt. The team is weighing pricing, rate limits and registration-design changes, while stressing that a user must still follow the correct inbound flow.1. Stability Comes Before the Next LaunchTHORChain had just shipped v3.20, but the episode opened with the harder follow-up: the network needed a v3.20.1 hotfix and a period of focused stability work before the roadmap could advance again.

Chad Barraford said the immediate issue came from the Rujira app layer sometimes querying API endpoints whose results could vary between requests. That variation can change gas consumption. In a consensus system, even a tiny difference in execution is unacceptable, so the team chose to pause new work while it fixed the current failure mode and watched the chain closely.

"We've had too much instability recently to just kind of keep on slogging forward." (Chad)The current patch was expected within roughly 24 hours, contingent on testing and node adoption. But the broader pause is not merely a hotfix window. The team wants at least one or two weeks to assess stability, then decide whether it can resume the roadmap or needs more time.

That means Zcash and Monero are waiting, alongside new feature rollouts, protocol-owned liquidity deployment and rev-share. The message is deliberately cautious: $XMR and Zcash are delayed, not abandoned. Churns should still resume during the stability period, but new chain launches are not the near-term priority.

The community also asked whether the app layer itself could be paused temporarily. Chad confirmed that it is technically possible, but said the team did not yet think it was necessary. The identified patch may be enough, though that judgment could change as more information arrives.

2. AI Strategy Is Still Taking ShapeBefore the technical updates, Denny highlighted a self-funded AI video from French Chad that had reached nearly 9,000 impressions. The anecdote led into a broader question: if agents increasingly initiate crypto activity, what should THORChain build for them?

Kenton said work on AI-engine optimization was beginning to show results in AI search. Chad took the longer view. He expects agents to account for a growing share of transactions, but he does not think the correct protocol strategy is obvious yet.

"The hard thing is figuring out what our strategy should be in that context." (Chad)Some ingredients already exist. Chad said a developer has been working on an open-source MCP server in THORChain's GitLab, though it had not been publicized. Agents can already broadcast a transaction with the necessary memo, so basic agent use does not require a new protocol feature.

The more ambitious possibility is an AI-friendly, command-line wallet with structured JSON output. Instead of asking an agent to operate a graphical wallet, it could hold assets, inspect transaction history and submit transactions through an interface designed for software. That idea is not a product commitment, and it may not be THORChain-specific. It is a direction the team is evaluating as the capabilities and economics of AI change.

Chad also clarified the role of Huginn. It is designed to operate independently, not as a chat assistant that a developer prompts directly. A GitLab issue can be assigned to Huginn, which then works through that task on its own schedule.

https://raynalytics.net/network-status/governance3. ADR30 Separates Operations From Fund ControlADR30 was at 38% approval during the show. The proposal would let a node operator delegate selected operational commands to another address without giving that address control of the node's funds or private keys.

That makes it a quality-of-life change rather than an economic redesign. An operator could split routine duties among people or systems while retaining the key material that matters for custody. The proposal was associated with Liquify, and Chad said he saw no material protocol-design risk beyond the normal need to implement and review the code correctly.

"The security, all that remains the same." (Chad)The vote was not presented as complete. Operators and bond providers still need time to review proposals, coordinate internally and vote. The conversation also returned to a possible future ADR that would require validators to participate in ADR votes, including an abstain option, so governance does not remain idle by default.

Other proposals remain in the queue, including free stablecoin swaps, per-asset minimum fee settings and Devel's limit-order idea. They can wait. The team was clear that stability outranks adding more work to the release path.

4. SwapKit Rev-Share Is Close, but Not ActiveThe planned rev-share arrangement with SwapKit is technically close on both sides. Chad said THORChain's work is ready for additional staging tests, while SwapKit's implementation was nearing completion. Under the proposed test, a portion of fees would go to a SwapKit-controlled bucket, where the partner could use it to compete for more external wallet flow.

"We'll start with 20%, we'll see how that goes." (Chad)That 20% figure is a starting point for a test, not a live setting. The team intends to judge the arrangement by the resulting data, then increase, decrease or stop it if the outcome does not justify the share.

Rev-share can be enabled through an operational Mimir vote, which ordinarily needs three agreeing nodes. But no activation should be read into that mechanism. The same stability pause affecting $XMR and Zcash also pushes the rev-share test back by at least one or two weeks.

The episode also touched on protocol-owned liquidity. v3.20 was meant to help direct system income into selected pools, but that work is now subject to the same pause. The team may later prioritize stablecoins, $XMR, Zcash or other pools, but no new allocation is expected while stability work takes precedence.

5. Memoless Swaps Are Paused While the Team Reworks DefensesThe memo registration feature used for memoless swaps was turned off after someone began repeatedly registering short memo identifiers in an attempt to capture an incorrectly sent inbound transaction. Each pool has roughly 100,000 possible identifiers, and the attacker tried to flood that space with registrations.

Chad's key distinction was important: the attempt can only succeed when someone sends funds to THORChain without including a memo and without registering the intended memo first. It is not a conventional compromise of a correctly formed THORChain Swap.

"The protocol gained money in this particular attack as of now." (Chad)The attacker pays to keep registrations active and, at the time of the episode, was operating at a loss. That does not make the design question irrelevant. The team is deciding whether to restart the feature as it is, make registrations more expensive as space fills, cap registrations per block, bind a registration more closely to the sending address, or include the expected amount in the registration. Each option creates different wallet and user-experience edge cases.

For now, the status is a pause and an active design discussion, not a finalized fix. The practical guidance remains the same: use an interface that constructs the transaction correctly, read its warnings and send a small test transaction before committing a meaningful amount. Self-custody gives users control, but it also makes transaction discipline non-optional.

What to Watchv3.20.1 and uptime: whether the hotfix is adopted cleanly and the team sees the stable operation it wants before reopening the roadmap.New-chain timing: when Zcash and $XMR return to the launch queue after the initial one-to-two-week stability review.ADR30: whether the delegation proposal clears its node vote and how quickly the remaining governance queue moves afterward.AI interfaces: whether the MCP server is publicized, and whether the agent-friendly command-line wallet concept becomes a concrete build.Memoless redesign: which registration defense the team chooses and when THORChain Swap can safely re-enable the flow.More THORChain data, check out raynalytics.net

Follow Raynalytics for more Weekly Analytics and Podcast recaps.

THORChain has resumed activity after over a month of security verifications and upgrades, following a $10.7 million exploit that prompted a trading halt on May 15.

In a Tuesday X post, THORChain said it restored its network, including trading, signing, swaps and liquidity provider actions.

On Sunday, the protocol said it had confirmed the safety of most of its vaults through the KeyVerify protocol and retired the remaining legacy vaults as part of a migration to a new set of vaults. THORChain called the upgrade the “most significant milestone” in its recovery process. It also said it completed verification of every node's keyshare on Friday.

THORChain is one of the crypto industry's largest cross-chain trading protocols, enabling swaps between networks such as Bitcoin and Ethereum. The protocol has drawn scrutiny from blockchain investigators because hackers have used it to move stolen funds between blockchains.

Source: THORChain

THORChain ships security upgrades and migrates old vaultsTHORChain attributed the exploit to a vulnerability in its GG20 threshold signature scheme, which is used to secure protocol vaults by distributing key control across multiple node operators. According to the protocol, the flaw allowed a malicious node operator to reconstruct a full private key through what it described as “progressive key material leakage,” enabling the theft of $10.7 million.

The protocol implemented an emergency patch on May 20 to protect the remaining vaults before releasing an upgrade on June 9, which included a fix for the exploited vulnerability. A follow-up upgrade was rolled out on June 11 with additional stability improvements and fixes to the KeyVerify protocol.

THORChain network overview, node upgrades. Source: THORChain Explorer

With the recovery process largely complete, THORChain has also outlined plans for new network integrations.

THORChain said it will launch native swaps and vaults for privacy-preserving cryptocurrency Zcash (ZEC) within the next two weeks, followed by Monero (XMR).

It also plans to launch support for the Bittensor (TAO) token in about six weeks after the network’s restart.

Magazine: 53 DeFi projects infiltrated, 50M NEO tokens could be ‘given back’: Asia Express  

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

PANews reported on February 23 that the IoTeX team tweeted that on February 21, they discovered an attack on the Ethereum side of their multi-chain bridge ioTube. The attackers stole 410 million CIOTX tokens and approximately $4.4 million in assets through four steps. Currently, over 86% of the CIOTX has been locked or frozen, 12.8% (52.4 million CIOTX) is being frozen in cooperation with Binance and other platforms, and only 0.4% (1.7 million CIOTX) remains at risk after being exchanged on DEXs. Regarding the bridge's reserve funds, the attackers exchanged the stolen reserve tokens (including USDC, USDT, WBTC, WETH, and other assets) for approximately 2,183 ETH . Of this, 1,572 ETH has been transferred to the Bitcoin network via THORChain.

The IoTeX team has taken emergency measures, including distributing patch fixes, freezing related addresses, and working with exchanges to freeze funds. The ioTube bridge service will be restored after an independent security audit, along with a compensation plan and security upgrades. The team is committed to ensuring the safety of community assets and will release a more detailed compensation plan and hold a community AMA within the next 48 hours.

Previously reported, IoTeX suffered a loss of approximately $2 million in assets and is expected to be operational within 48 hours . Upbit has added IoTeX (IOTX) to its transaction alert list .

Decentralized finance (DeFi) platform Aave has suspended operations in a number of markets after receiving a problem report on a certain function of the protocol.

DeFi Protocol Discovers Vulnerability; Is User Funds At Risk? On Saturday, November 4, decentralized lending protocol Aave announced – via a post on X (formerly Twitter) that it has paused the Aave V2 Ethereum market and suspended certain assets on Avalanche. In addition, the protocol has frozen specific assets on Aave V3 on Polygon, Arbitrum, and Optimism. 

Today we received a report of an issue on a certain feature of the Aave Protocol. After validation by community developers, the guardian has taken the following temporary prevention measure (no funds are at risk):

— Aave (@aave) November 4, 2023

According to the protocol’s announcement, these actions serve as a temporary precautionary measure following a problem report on a specific feature. 

Furthermore, Aave said in the post that the Aave V3 markets on Ethereum, Base, and Metis and the V2 markets on Polygon and Avalanche are unaffected. Meanwhile, no funds on any of the markets were at risk, according to DeFi lending protocol.

🚨🚨 🚨 On 11-04 17:38:35 UTC, Aave Guardian has taken necessary protection measurements to pause AaveV2 protocol (and all Aave pools are safe): https://t.co/3xJzfiejig

Given the protocol is “forked” by multiple third parties and the exact details are not disclosed yet, it is… pic.twitter.com/OkO1EZv6pW

— PeckShield Inc. (@peckshield) November 4, 2023

While Aave did not specify what the issue is or the feature that caused the problem, the protocol said it would release a detailed explanation once there is a full resolution. The statement read:

A governance proposal to restore the normal operation of the protocols will be submitted shortly. A detailed postmortem will be released once the issue is fully resolved.

Aave further clarified that users supplying or borrowing from a frozen assets pool can still withdraw and repay positions. However, these users can’t supply or borrow more funds from the frozen assets pool until the issue is resolved. The protocol added: 

On paused assets, no action can be done until unpaused.

AAVE Price Remains Steady Despite Protocol Vulnerability There is no evidence to suggest that the problem has had any impact on the value of the protocol’s native token, AAVE. As of this writing, the token is valued at $90.15, reflecting a negligible 0.9% price dip in the past 24 hours.

Nevertheless, the token is outperforming on a bigger timeframe. Over the past week, AAVE’s price has swelled by more than 10%, touching the $100 mark – for the first time since February – at some point during the week.

Although the price of AAVE  has been moving mostly sideways in the past few days, a resolution of the current issue might trigger renewed momentum for the token. Hence, there is a chance that the cryptocurrency might revisit $100 again, especially considering the optimistic climate of the crypto market.

AAVE price slows down upward momentum on the daily timeframe | Source: AAVEUSDT chart on TradingView Featured image from Binance Academy, chart from TradingView