THORSday Community Podcast #244 ft. CBarraford, KentonC137 & Patriotsounds | October 22, 2026 | Watch the full episode on YouTube
By Raynalytics
TL;DRv3.21 was about 13 hours from adoption. Chad expects to cut v3.21.1 next week once two more pull requests merge, and once the paused churn resumes, $XMR is ready to launch.In its second week, SwapKit Rev-Share spent $841.60 in credits on swaps that earned THORChain $3.72K in fees, a 4.4x return that held steady as spending doubled.Chad is turning block time into an adjustable mimir so THORChain can step down from 6 seconds to 2 seconds one second at a time, and step back up without a new binary.About 20% of nodes have started voting to end rewards to liquidity pools. Kenton wants a formal ADR, while Denny and Chad made the case for protocol-owned liquidity (POL) instead.Chad unveiled Visual Review, a tool that turns any code change into an explainer page, and the solvency checker halted a small IBC exploit on its own at a loss of about $800.1. Monero Is Two Pull Requests and a Churn AwayAt recording time, v3.21 was roughly 13 hours from adoption. Chad said two more pull requests need to merge before the team can cut v3.21.1, which he expects next week. The churn is currently paused for issues that v3.21 fixes, so the remaining sequence is: adopt v3.21 and v3.21.1, restart the churn, and launch Monero.
"Once that's out and the churn is churning, we're live." (Chad)A community member asked whether THORChain could be a reorg target, citing the Qubic selfish-mining incidents on Monero. Chad said it comes down to confirmation counting. He described a method JP created years ago: wait enough blocks that the block rewards in that window exceed the value coming into the protocol. More confirmations mean slower trades, but because THORChain has no decentralized competition for $XMR and competes mainly with centralized exchanges, speed matters less at launch. Chad leans toward a higher confirmation count to start, with the exact number still to be researched. For contrast, he recalled Erik Voorhees telling him that ShapeShift used a single confirmation on Bitcoin for its whole history without a reorg incident.
Shielded Zcash addresses are not coming soon. Chad used AI to generate a full implementation in about 12 hours, but it added roughly 20,000 to 30,000 lines of code, and the devs pushed back on the complexity. What tipped Chad was Maya Protocol's data: only about 15% of its Zcash volume uses shielded addresses. The Zcash community is also working on rotating transparent addresses, which Chad expects would need no changes on THORChain's side. He will be at Zcash Foundation's Zcon7 in Cancún next week.
Beyond Monero, BSC is now on Router v6 alongside Base and Avalanche, and churnless chain additions are targeted for the next release or the one after. Asked about Zano, Chad said it is still well back in the queue. He named Substrate-based chains, Bittensor's $TAO and Dash as the short list after Monero, which he called by far the hardest chain THORChain has integrated.
2. SwapKit Rev-Share Holds at 4.4x in Week TwoChad returned to Ray's SwapKit Revenue Share dashboard for a second weekly check-in. Under the 20% Rev-Share, SwapKit has accrued $7.03K in credits and spent $841.60 of it on quote discounts, leaving a $6.19K balance. Swaps carrying those discounts earned THORChain $3.72K in fees, a 4.4x return, slightly below the 4.6x of week one. The discounted swaps added up to $1.96M in volume across 778 swaps, an average of about $2,500 each.
Chad's summary was that the numbers held. Spending roughly doubled over twice the time, and the ratio barely moved, which the hosts called a great sign.
The open question is still scale. Chad expects SwapKit to raise its spending after v3.21, and the hosts noted that the release fixes an affiliate code bug that should let SwapKit add more partners. If the ratio stays around 4.4x to 4.5x, he said raising the share from 20% to 25% would create the flywheel discussed last week, where every dollar SwapKit spends returns more than a dollar to its bucket, until SwapKit's market saturates. Week one is covered in last week's recap.
3. Should THORChain End LP Rewards?Kenton raised a vote already in motion: roughly 20% of nodes, about 27, have started voting to cancel rewards going to liquidity pools. Because it would be a big change to THORChain's economics, he suggested someone write a formal ADR.
The backdrop: for months the incentive pendulum sent nearly all rewards to nodes, then 20% of system income began flowing to POL. Now the pendulum is swinging back, and rewards are reaching legacy LPs again. Kenton's concern is that LPs need $RUNE to outperform to break even, but that same outperformance erodes the value of their accumulating rewards through impermanent loss. He believes POL should replace LPs over time. He also steelmanned the other side: if $RUNE never outperforms enough, those rewards could help pay LPs back. Boone has proposed paying rewards out to LPs directly to shield them from impermanent loss, and wrote in chat that most LPs would not benefit from rewards at current prices because synth leverage is so severe.
Denny, speaking as an LP, backed POL over LP rewards. Ray's POL Income dashboard shows 1.23M $RUNE of system income collected for POL, about $791,500 at current prices. Kenton added that $RUNE tracks volume, volume needs liquidity, and THORChain has lost roughly 75% to 80% of its liquidity since THORFi. He would end the rewards if it were his call, while acknowledging that node operators are also struggling on low yields. Node income is tracked on Ray's THORChain Financials page.
"We are grinding our way out of this hole. It's happening." (Denny)Chad favored POL because it is not mercenary capital. If there were another hack, POL would likely be first in line to absorb losses, rather than the Treasury, which paid for most past incidents. He said he wished THORChain had launched with both streaming swaps and POL from day one. For background, see the recap covering POL's launch.
4. A Gradual Path to 2-Second BlocksChad is revisiting 2-second blocks. The original code was merged about a year and a half ago, then pulled back because a hard switch felt risky and difficult to undo. His new approach is to make block time a mimir rather than a code change, so THORChain can move one step at a time and roll back if needed without releasing a new binary.
"We can walk it down from 6 seconds, what it is now, to 5 seconds to 4 seconds to 3 seconds to 2 seconds." (Chad)His analysis of mainnet suggests 2 seconds is a safe target: about 99% of blocks already complete in under 2 seconds. Around 1.5 seconds might be possible with Cosmos SDK performance gains, but Chad would be cautious. The mimir will be hard-coded to a range of 1 to 10 seconds, and going below 1 second would mean forking or replacing CometBFT, the consensus layer underneath.
On paper, the benefits are clear: streaming swaps would execute three times faster, arbitrage bots would rebalance pools more often, and the Rujira app layer would gain from faster blocks. Chad wants to measure how much of that shows up in practice before pushing lower, and hopes to move ahead within the next month or two. The idea first resurfaced in last week's recap.
5. The Quote-Versus-Fill Test Gets CheaperThe test proposed last week, comparing swap providers' quotes with what users actually receive, is moving forward with Treasury support. Kenton said he and Ray are working out the procedure, and credited Ray for running the numbers. The original plan of $1,000, $10,000 and $100,000 swaps would have meant a few million dollars in volume and, once fees and spreads were included, a cost of a couple hundred thousand dollars. The revised plan uses only $1,000 swaps: around 400 to 500 of them, roughly $400,000 to $500,000 in volume, for a cost of a few thousand dollars. Kenton said THORChain already wins larger quotes, and the low end of the size curve is where it misses volume, so that is the range worth studying.
On marketing, Kenton listed THORChain on a no-KYC exchange directory and asked the community to leave a review. THORChain will appear on the directory's exchange list once it has an XML quote feed, which Liquify agreed to build. He also asked the Unstoppable Wallet devs about Tor (.onion) and I2P addresses for THORChain Swap and set up a THORChain page on Bitcointalk.
Kenton's focus remains AI search. thorchain.org sits in the top 500 of about 120,000 sites on an AI-visibility tracker, though still at a B grade, and new affiliates requesting API keys say they found THORChain through ChatGPT, Claude or Google search. He is also looking into ChatGPT's new advertising, which could open a paid channel crypto lacks on Google.
After a press outlet turned a post about a 140 $RUNE Zcash pool bug into a negative story, Kenton said issues will still be disclosed on Discord and GitLab, but the main X account does not need to spotlight every minor bug.
6. Visual Review Turns Code Changes Into ExplainersChad unveiled Visual Review, a skill he built that turns a code change into a web page explaining it visually. He showed it on his dynamic fee merge request. The page includes a five-minute explainer video with chapters, interactive graphs, and a narrated walkthrough of every changed line, with fuzzy search by file name, function or snippet of code. The goal is to let anyone, technical or not, understand a change before it merges.
"It's my attention and my focus that is the most valuable resource in this process." (Chad)The merge request he showed runs to about 27,000 lines, of which roughly 1,483 are logic changes; the rest are tests and documentation. Huginn will generate these pages automatically, with a button at the top of each pull request. Chad has open-sourced the skill on GitLab, and Kenton added a Visual Review link to the thorchain.org footer during the show.
The dynamic fee change itself replaces the current step search, which moves 1 bps at a time, with a bracket search. Instead of trying 1, 2, 3, 4 and 5 bps, the model jumps from 1 bps to 20 bps, then tests the midpoint and narrows in. Bigger jumps make the market's reaction clearer and reach the best fee in fewer epochs. The change also lets the team switch an affiliate such as Symbiosis off and on to reset its data. Chad hopes to merge it for v3.22.
7. The Solvency Checker Stops an IBC ExploitTHORChain had what Chad called a tiny mini hack this week. A bug in the IBC implementation let an attacker make THORChain believe it had received $ATOM it never received. The first fake deposit was about 16 $ATOM, roughly $20, sent with a bad memo that triggered a refund. The attacker kept doubling that amount across five transactions.
The solvency checker only acts once a shortfall reaches $500, a buffer that avoids halting the chain over small discrepancies. Once that line was crossed, it halted things within about 20 to 30 seconds, with no human involvement, after an attack lasting seven or eight minutes. Chad expects the roughly $800 shortfall to be refilled from the reserve, probably in the next release. In chat, a viewer offered to open a merge request setting the threshold at $42,069.
"It's a success story in my mind, even though it's only $800." (Chad)Chad also wants more math-based safety checks. AI recently helped solve how to account for synthetics in LUVI, a measure that separates pool earnings from price moves and should almost always rise, so it can now act as an invariant that flags broken pool accounting without knowing the cause. LUVI checks were added to regression testing last week, and Chad plans to add them to mainnet code eventually, though it is not a top priority.
A community member also asked why the reserve holds about 25M $RUNE. Chad was not sure and suspects it relates to accounting from the summer hack. Kenton thought a store migration in v3.21 might address it. Long term, Chad said, the reserve would have a cap, with anything above it paid out as system income.
8. Faster CI and Huginn's Growing RoleChad shared a summary of recent changes to THORChain's continuous integration (CI), the automated tests every code change must pass. The team now runs nearly three times as many CI jobs per day, has added more than 1,300 unit tests, and introduced fuzz testing, mutation testing and adversarial-quorum testing. Typical CI time fell from 97 minutes to 24 minutes, and even the worst cases now finish in under 50 minutes, down from waits as long as seven hours.
Asked whether a large language model could formally verify the THORChain stack using Lean, Chad said Lean is a language for mathematical proofs and he does not think it applies to code. Instead, Huginn reviews every change and continuously audits the codebase, tracking which files it has scanned. By Chad's count, Huginn has found more security issues in the past year than every human contributor combined, by orders of magnitude, and it currently reports only the two highest priority levels. A full audit by the security team also turned up a few dozen issues, which are being addressed.
The bottleneck is human review. A community developer recently opened six or seven merge requests; generating one can take five minutes, while reviewing it can cost several engineers 45 minutes each. Chad estimated THORChain could merge 10 to 20 times more code per release without that constraint, though he stressed humans still review everything. Huginn now runs on its own Treasury-funded accounts, which freed Chad's own AI usage for projects like Visual Review.
"If you write code without having AI involved in that process, you're probably doing it wrong." (Chad)What to Watchv3.21 adoption, the v3.21.1 cut expected next week, and the churn resuming ahead of the $XMR launch.Whether SwapKit scales its Rev-Share spending after v3.21, whether the return holds near 4.4x, and whether the share moves to 25%.Whether an ADR on ending LP rewards is written, and how many nodes join the vote.The 2-second block mimir, hoped for within the next month or two.The dynamic fee bracket search in v3.22, and Visual Review pages on every pull request.The quote-versus-fill test, once Kenton and Ray finalize the procedure.Kenton's quarterly report, which he hopes to work on this weekend.Chad at Zcon7, a possible technical Rujira session with Pragmatic Monkey or CodeHans, and Chad's planned appearance on Joel Valenzuela's show.Schedule changes: Zodl on Friday, October 23, and the Saturday show moving an hour later.More THORChain data, check out raynalytics.net
Follow Raynalytics for more Weekly Analytics and Podcast recaps.
SummaryTHORChain processed approximately $3.82 billion in volume in Q3 2026 and generated around $5.77 million in fees, nearly double Q2 on both counts, in its first full quarter since the June 22 restart. September alone accounted for $2.41 billion as funds from the Bitget exchange hack moved through the network. Excluding those five days, volume and fees were still above Q2.
On the protocol side, v3.20 shipped in late August, bringing back validator churn after more than 60 days and activating Protocol-Owned Liquidity (ADR-024), which now receives 20% of system income. Dynamic fees (ADR-026) went live with ShapeShift, then Edge Wallet and Symbiosis, node operators approved affiliate revenue share (ADR-029), and ADR-031 confirmed the cooperation with Rujira. The quarter also included a two-day halt in late August and a stability sprint that put new launches on hold until mid-September.
THORChain also came under heavy public pressure to block the hacked flows and held to its position as neutral, permissionless infrastructure. Looking ahead, several chains are about to go live such as Zcash, Monero, TAO while ADR-030 (delegated node permissions) and base-layer limit orders are still under discussion.
A Look At Q3 2026 MetricsGeneral Metrics:Total USD Volume: $3.82BHighest 24h Volume: $467.74MChange in Total Liquidity: $54.58M to $89.82MSwap Fees Collected: $5.77MAffiliate Earnings: $1.38MAffiliate Volume: $1.42BTop Swap Routes By Volume:1. BTC <> ETH: $1.18B
2. BTC <> USDC: $466.66M
3. BTC <> XRP: $446.30M
4. BTC <> USDT: $267.83M
5. BTC <> LTC: $133.76M
Top Swap Routes By Swap Fees Collected:1. BTC <> ETH: $2.51M
2. BTC <> XRP: $1.38M
3. BTC <> USDC: $989.4K
4. BTC <> USDT: $575.9K
5. BTC <> LTC: $319.1K
Top Affiliates By Swap Volume1. THORChain.org - $545.76M
2. SwapKit - $208.55M
3. naswap - $92.96M
4. Trust Wallet - $87.66M
5. thor18dvg…kjm4 - $63.27M
What’s New On THORChain In Q3 2026Network And Protocol UpdateNetwork Back Online, With ExceptionsValidator churn stayed halted for more than 60 days after the June restart, until v3.20 went live in late August. Churn then resumed on a three-day cadence, and the active set went from 95 nodes in July to 103 at the end of September, with total bond up to 97.66M RUNE.
A few services were not yet back: Solana trading (which v3.20 started preparing to resume) memoless transactions, switched off in August after an attacker repeatedly registered short memo identifiers, and Rujira’s bond contract and its trading pair, kept disabled for additional checks when the App Layer resumed on September 3.
Protocol Upgrade v3.20v3.20 was the quarter's main release, with 61 merge requests merged in v3.20.0 and 75 across v3.20.0 to v3.20.3. Beyond churn and POL, it shipped the Monero and FROST groundwork, Zcash NU6.3 support, fixes to resume Solana, BNB Chain and Base trading, memoless swaps for ERC-20s, an experimental Stable Reserve (disabled by default), the MOR token, and the ADR-030 code.
Stability FocusThe weeks after v3.20 were dedicated to stability. On August 26 and 27, the network halted because nodes no longer agreed on its state. The cause was traced to Rujira App Layer contracts that could return different results on different nodes. A v3.20.1 hotfix followed, and the App Layer stayed paused until the issue was fixed, resuming by September 3.
From August 27, new launches were put on hold. Zcash, Monero and the SwapKit revenue share test were pushed back, but churns continued, and the first one after v3.20 cut average block times by about 300 milliseconds. The team also fixed a TSS signing issue with follow-up v3.20.x patches and began rolling out Router v6 one EVM chain at a time, starting with lower-risk routes.
The sprint ended on September 17, and THORChain returned to normal operation. It also produced clear guidelines for the App Layer: base-layer queries must give the same result on every node, contract execution must be bounded, and future incidents will follow a set process to halt, contact the affected team and agree on a restart path.
ADR-024: Protocol-Owned Liquidity - ExecutedProtocol-Owned Liquidity went live with v3.20, which made the POL Mimir controls operational. Node operators set the POL share at 20% of system income, and the reserve deploys RUNE into eligible pools (L1 gas assets and approved stablecoins) ranked by their fees-to-depth ratio over three days. The first position went to the TRON.USDT pool. By the end of September, the reserve had deposited 946K RUNE, with positions worth about $679K and around $113K in fees earned.
Alongside POL, node operators cut the RUNE burn from 5% to 1% of system income in mid-September. System income is now split between nodes (59%), POL (20%), TCY (10%), the Dev Fund (5%), the Marketing Fund (5%), and the burn (1%).
ADR-026: Dynamic Fees Live With First PartnersThe dynamic minimum fee went live for whitelisted partners this quarter, starting with ShapeShift. Each partner's fee floor adjusts by 1 bp per day for each selected trading pair, based on fee revenue. A v3.20 update opened the mechanism to more partners, with node operators enrolling Edge Wallet and Symbiosis on September 26. Data is currently being tracked to assess the effectiveness of the mechanism over time.
ADR-028: Pool Reconciliation - Completedv3.20 completed the residual remediation under ADR-028. The Migrate17to18 store migration finished the post-exploit pool reconciliation started in Migrate15to16: it removed phantom depth from 26 pools, reset 4 seed pools (BSC.USDC, BSC.USDT, BASE.ETH and ETH.THOR), and sent the freed RUNE to the Reserve rather than burning it.
ADR-029: Affiliate Revenue Share - PassedNode operators approved ADR-029 in August. REVSHARE lets THORChain return part of its liquidity fees to an approved affiliate THORName, set per THORName through a Mimir key and capped at 50% of the fees that affiliate generates. The payout is taken from system income before it is split, and no RUNE is minted. SwapKit is set to be the first partner tested, as outlined in What's Coming Next below.
ADR-031: Rujira Cooperation Confirmed - ExecutedNode operators adopted Option 1 of ADR-031, confirming and reinforcing the exclusive cooperation with Rujira on the App Layer. THORChain provides Base Layer security and infrastructure, and Rujira builds the App Layer products. Rujira's revenue is now split three ways: 33.34% to a POL Fund owned 50/50 by Rujira and THORChain, 33.33% to THORChain, and 33.33% to RUJI stakers, which keeps THORChain's economic share at 50%.
On top, WasmArbSlipMinBps was set to 0 so the Virtualization Strategy can settle smaller trades more often and tighten quotes. ADR-031 also sets responsibilities in case of an exploit: smart contract exploits fall to Rujira, and Base Layer exploits affecting Secured Assets fall to THORChain.
Monero Audit By Least AuthorityLeast Authority audited THORChain's Monero integration this quarter, with findings delivered in late August. By September 30, 7 remediation merge requests had been merged (5 public and 2 private security fixes), and the fixes will ship in v3.21 coming in October. Completing this remediation is the main gate before Monero goes live on mainnet.
Exploit Post-Mortem - PublishedTHORChain published two further reports on the May 15 exploit.
Exploit Report #2 (July 3) sets out the root cause: three individually low-severity weaknesses in the GG20 signing implementation, a fork of Binance's tss-lib that predated upstream fixes, which the attacker chained together by deliberately failing signing rounds 864 times over about two and a half days.
Exploit Report #3 (August 6), prepared by THORSec/Soda Labs, is the technical deep dive into the three bugs and the fixes now in production.
v3.20 added encryption at rest for TSS keyshares, and the medium-term plan remains to move off GG20, using FROST for Schnorr chains and DKLS for ECDSA chains.
THORChain Holds To Its Ethos Under Public PressureOn September 24, Bitget lost about $387.5 million in a hack of its hot wallet infrastructure, and part of the stolen funds was swapped through THORChain over the following days. Between September 25 and 29, the network processed about $1.38 billion in volume, more than half of September's total.
The flows put THORChain at the center of a public debate. On September 26, Bitget CEO Gracy Chen asked THORChain to refuse service to the attacker's addresses, and OKX founder Star Xu argued that THORChain's ability to halt makes it an intermediary.
THORChain declined the request the same day and held its position throughout. It is a decentralized and permissionless network, like Bitcoin or Ethereum, with no mechanism to block an individual swap, sender, or recipient. Node operators can pause a chain or the network when solvency is at risk, and that halt applies to every user at once: a minority of one-third plus one can stop activity, while any protocol action requires a two-thirds supermajority.
THORChain also reminded that the same rule applied after its own May exploit, when the attacker's addresses were not blacklisted either, similarly to the Bybit and KelpDAO incidents. As Chad explained on Unchained, blocking flows fast enough would mean redesigning THORChain into a more centralized system which can be done if and only if the nodes decide to do it.
Partners And IntegrationsData AccessTHORChain partnered with DefiLlama to launch an investor relations dashboard, giving an independent view of the protocol's fees and revenue, income statement, affiliate and integration leaderboards, swap activity and several more metrics.
Blockworks, which acquired Messari at the end of Q2, announced its THORChain dashboard, taking over the data previously covered by Messari. Work with Raynalytics, Dune and Numia also aims to move public data updates from daily to hourly.
Community member Boone also launched boone.tools, a set of 16 dashboards tracking pools, Protocol-Owned Liquidity, RUNE burns, node bonds, vaults, the Treasury, dynamic fees, governance votes and the App Layer, along with a comparison of THORChain's profitability against Chainflip and NEAR Intents.
FrontendTHORChain Swap added Exodus browser wallet support and Trezor support for XMR, and introduced an optional Houdini Swap private route, which runs through an off-chain intermediary separate from THORChain's native swap engine.
IntegratorsRAVN: a native-asset aggregator in public beta that ranks quotes from more than 13 venues, including THORChain.
BazaarSwap: aggregates over 360 exchanges across 160 blockchains and settles trades natively through THORChain when it offers the best route.
depouch: routes swaps across THORChain, Maya Protocol and NEAR Intents.
NanoGPT: settles crypto payments for its AI models through THORChain.
What’s Coming Next On THORChainNew Chains IntegrationZcash is first in line: the integration is complete, and its pool will be created at the next successful churn, using Zcash's transparent UTXO infrastructure. Trading will start in October.
Monero will follow as a cautious soft launch with a ramp period of several weeks. Its code is in place and already trading on stagenet, node operators will get about three days' notice to enable it.
TAO is expected about six weeks after Monero, with DASH and Zano also in the pipeline.
V3.21 - Planned for Octoberv3.21 is being prepared. It targets a churn-related slashing regression along with App Layer and signing issues. Memoless transactions, switched off in August after an attacker repeatedly registered short memo identifiers, are also being redesigned, with a ramping registration price under consideration.
ADR-030: Delegated Node Operator Permissions - In DiscussionADR-030 would let operators delegate routine actions (maintenance mode, leave requests, fee changes, bond-provider whitelist) to lower-privilege hot wallets while keeping the BondAddress cold. The code shipped in v3.20 and can be activated in v3.21, but the vote stood at about 37% support in early September, short of the two-thirds required.
SwapKit Revenue Share Test - UpcomingWith ADR-029 approved, SwapKit is set to run the first revenue share test in October. THORChain will credit 20% of the revenue from SwapKit-routed swaps to a bucket that SwapKit spends on better quotes. The test will run for one to three months and can be switched off if it doesn't benefit both sides.
Pushed back by the stability sprint, the test will start once SwapKit's side is ready. Success will be measured on net fee income: the discounts have to bring in enough new volume to more than offset the 20% share. The coming weeks should give a clear view of how well the design works.
Base-Layer Limit Orders - In DiscussionNode operator Devel has proposed base-layer limit orders (BLO), which would sit alongside AMM pools to improve quotes, execution speed, and refunds. The proposal would start narrow, with single-pool RUNE-denominated orders inside a 2% band around market price, and is being discussed alongside Rujira's Dynamic Concentrated Liquidity, now in testing.
Ongoing Work From Previous QuartersWork also continues on initiatives from previous quarterly reports, including the migration from GG20 to FROST and DKLS, the Stable Reserve, and onboarding more partners to dynamic fees.
Monero takes center stage in THORChain v3.21. One of the network's most anticipated integrations is now a step closer to activation, with this latest wave of merge requests addressing critical aspects of signing, recovery, and operational readiness.
Beyond Monero, v3.21 brings several other improvements:
A one-time state migration corrects historical bond and pool accounting and restores the ETH.THOR pool.Solana gains support for the new transaction format that halted trading, clearing the way for it to resume.Zcash trading can resume after fixes to how ZEC outbounds are matched.Memoless Swaps get new spam protection ahead of their return.Limit Swaps can be turned back on, with fixes for the bugs that bloated THORChain's state.The App Layer gets the fixes it needs to restart after the Rujira FIN exploit.A redesigned affiliate rewards system keeps each integration's earnings and payouts separate, letting SwapKit switch THORChain back on for its partners.Bond providers get Streaming Yield, a new way to take part of their rewards as income without waiting for their node to churn out.The release also includes a broad range of stability, security, and reliability improvements across chains, assets, node operations, and outbound execution.
Monero Gets Ready for ActivationMonero is getting closer to launch, but integrating a privacy-focused chain brings challenges that go well beyond simply signing transactions.
Building on v3.20, this release strengthens nearly every part of the XMR integration, from FROST key generation and reorg recovery to scanner reliability, spent-output tracking, and signing readiness. The objective is to ensure the network can recover safely when things don't go as planned.
XMR activation remains gated and requires a follow-up v3.21.1 release. Once accomplished, the integration will follow the usual soft-launch approach, with rounds of testing and shallow liquidity during the initial weeks.
MR !5026 - FROST Keygen & Rollout Hardening
Improves FROST keygen coordination, prevents messages from being lost when nodes progress through rounds at different speeds, and introduces explicit controls for enabling XMR keygen.
MR !5045 - Least Authority Follow Up: Harden FROST Stream Lifecycle and DKG Delivery
Adds retry handling for FROST keygen messages and strengthens stream cleanup and signer handling, following recommendations from the Least Authority XMR audit.
MR !5068 - XMR Reorg & Errata Recovery
Makes XMR reorg outcomes durable so recovery can continue across validator churns and restarts without repeating slashing or accounting effects.
MR !5109 - Preserve XMR Reorg History
Keeps the reorg history needed for recovery while a vault catches up, preventing important transaction history from disappearing too early.
MR !5112 - Scanner Recovery After Churn
Allows the XMR scanner to safely rewind and resume after a node becomes active, including when the recovery process is interrupted by a restart.
MR !5111 - Safer XMR Quote Destinations
Prevents quotes from accepting XMR destination types that the signer can't support and stops invalid unsigned outbounds from repeatedly blocking valid transactions.
MR !5037 - Safer XMR Refund Addresses
Requires an explicit refund address for XMR swap and limit-order quotes, ensuring funds can be returned safely if a transaction fails.
MR !5120 - XMR Catch-Up Finalization
Allows spent-output information recovered directly from THORChain consensus to be finalized during catch-up.
MR !5121 - Recover XMR Outbounds From Consensus
Rebuilds missing outbound and spent-reference information from THORChain's persisted consensus state after churns, restarts, or historical recovery.
MR !5124 - XMR Startup & Signing Readiness
Prevents XMR recovery problems from blocking Bifrost startup for every other chain and only allows XMR signing once the required recovery state is ready.
MR !5052 - XMR Network Verification
Makes Bifrost verify that the Monero signer and daemon are connected to the correct network before allowing the XMR client to start.
MR !5153 - XMR Consolidation Mimirs Become Operational
Makes XMR consolidation controls operational Mimirs, allowing node operators to quickly tune or disable consolidation while the integration is still new.
Mainnet State Migration & Recoveryv3.21 introduces a significant state migration to correct historical accounting issues and restore liquidity across several areas of the protocol.
The migration includes reversing a historical bond slash that affected 218 bond providers, reconciling Secured-Ops liquidity donations, restoring the ETH.THOR pool, and retiring the synthetic assets of seven low-utilization pools.
MR !5175 - Mainnet State Migration
Introduces the migration needed to correct historical bond and pool balances, restore ETH.THOR liquidity, and retire the synthetic assets of selected pools, with safeguards against inconsistent accounting.
Solana Outbounds Get More ResilientSOL trading was halted after Solana activated a new transaction format in mid-September that Bifrost couldn't read, breaking Solana fee sampling on every node. v3.21 ships the fixes needed to resume trading.
Solana's short-lived blockhashes create a second challenge for THORChain: when signing takes too long, transactions can expire before they are broadcast, particularly during vault migrations.
v3.21 introduces an optional durable nonce mechanism to give Solana outbounds a longer signing window. Combined with improved recovery for expired and stuck transactions, this makes outbound execution more resilient when signing doesn't go according to plan.
MR !5091 - Solana Versioned Transaction Support
Lets Bifrost read Solana's new versioned transactions, restoring fee sampling and making sure vault deposits sent in these formats are observed. This fix first reached Bifrost in the v3.20.3 patch.
MR !5128 - Solana Durable Nonces
Allows each SOL vault to use a durable nonce so outbounds no longer depend entirely on short-lived recent blockhashes. The feature is Mimir-gated and disabled by default.
MR !5154 - Durable Nonce Queue Recovery
Fixes an edge case where multiple exhausted SOL outbounds from the same vault could end up waiting on each other indefinitely.
MR !5096 - Solana Blockhash Expiry Recovery
Improves how Bifrost detects expired or unavailable Solana signing blockhashes, preventing migrations from retrying an impossible signing attempt for the entire signing window.
Affiliate Accounting Gets ReworkedPreviously, if one owner controlled multiple THORNames, those THORNames could share the same Affiliate Collector. That meant fees earned by different integrations could be pooled together, making it harder to track who earned what and which payout settings should apply.
v3.21 changes this by giving each THORName its own Affiliate Collector. Affiliate fees, REVSHARE, and preferred payout settings are now tracked separately for each integration.
The change opens the door to cleaner multi-partner affiliate programs. Wallets, aggregators, and other integrators can operate multiple THORNames under one owner without mixing revenues, recipients, or payout assets. The fix also allows SwapKit to turn THORChain back on for several of its integrators.
MR !5086 - Separate Affiliate Collectors
Gives every THORName its own Affiliate Collector, separating affiliate fees, REVSHARE, and preferred-asset payouts between integrations.
Streaming Yield for Bond ProvidersBond providers usually have to wait for their node to churn out before they can withdraw their rewards. Streaming Yield, called Bond Yield in the protocol, lets them have a share of their future rewards paid out at every churn instead, while the rest is automatically rebonded.
Payouts are sent in RUNE to the provider's own address, another THORChain address, or a THORName the provider owns, which can convert them into its preferred asset through its Affiliate Collector. The node operator fee is taken first, and existing bond and rewards already earned still follow the usual unbond rules. The feature ships disabled and goes live once enabled through Mimir.
MR !4814 (commit 12cee82a) - Bond Yield Payouts
Adds the BONDYIELD memo that lets each bond provider set the share of future rewards paid out automatically and where it goes. If a payout can't be completed, that share is rebonded instead.
Memoless Swaps Prepare to ResumeFollowing the expansion of Memoless Swaps to ERC-20s in v3.20, the feature was paused after attempts to spam the system by registering large numbers of memo references.
v3.21 introduces dynamic registration costs to address this issue. Instead of charging a fixed amount, registration becomes increasingly expensive as available reference slots fill up, making large-scale spam attacks more costly.
MR !5022 - Dynamic Memoless Registration Costs
Introduces a configurable pricing mechanism that increases memo registration costs as available reference slots become occupied, helping protect Memoless Swaps against spam. Governance must enable it through Mimir; until then, registration keeps its current flat cost.
ZcashAn outbound matching issue led to a ZEC vault slash. No user funds were lost, but ZEC trading has been halted until these fixes go live.
MR !5213 - Zcash v6 Transaction Support
Updates THORChain's Zcash signer to support v6 transactions following the NU6.3 network upgrade, while preserving compatibility with existing v5 transaction checkpoints.
MR !5193 - Better TEX Address Support
Converts Zcash TEX destinations into the equivalent transparent address used by the Zcash daemon for outbound scheduling, observation, and accounting.
MR !5010 - Consistent Outbound Destination Matching
Makes all outbound matching use the same destination comparison rules, including equivalent Zcash address formats, so valid payments are correctly recognized.
MR !5099 - More Consistent ZEC Input Selection
Makes validators choose a more deterministic set of confirmed ZEC inputs, reducing the chance of TSS signing parties splitting because nodes constructed different transactions.
TRONMR !5114 - Preserve TRON Observations During RPC Failures
Stops Bifrost from advancing past a TRON block when a required receipt lookup fails, ensuring vault deposits and outbounds aren't silently skipped.
New Ethereum TokensMR !5080 - cirBTC Whitelisted
Adds Circle Wrapped Bitcoin, cirBTC, to THORChain's Ethereum mainnet token whitelist.
App Layer & SchedulingThe App Layer has been halted since the exploit of Rujira's FIN contract. v3.21 ships the fixes needed before node operators can restart it.
v3.21 brings two changes to how the App Layer handles contract execution and scheduling. The upgrade removes an unnecessary execution delay and retires the direct Layer 1 contract invocation path.
MR !5144 - Same-Block Scheduling
Removes an extra one-block delay from the scheduler, allowing scheduled contract actions to execute at the intended block and supporting same-block scheduling when the delay is zero.
MR !5132 - Remove the X Memo
Removes the X / EXEC memo path that allowed a Layer 1 transaction to directly execute a THORChain Wasm contract.
Better Swaps, Limit Orders & QueriesLimit Swaps were paused after a bug bloated THORChain’s state. Orders that had run out of funds were never closed. Instead, the network retried them every block and stored each failed attempt’s error message, until about 670 open orders were carrying roughly 57 MB of error data.
v3.21 fixes the cause and limits the damage if something similar happens again. Underfunded orders are now settled instead of retried, the error history stored for each swap is capped, and the Advanced Swap Queue is indexed so it does less work each block as activity grows. Together, these changes allow Limit Swaps to be turned back on.
The release also makes quote and query endpoints deterministic, so every validator returns the same result for the same request.
MR !4807 - Trade/Secured Swap & Limit Order Fixes
Tracks the amount actually consumed during Trade and Secured Asset swaps and correctly settles limit orders that become underfunded or can no longer execute because of rounding.
MR !5027 - Deterministic API Queries
Removes nondeterministic behavior from quote and query endpoints, including random placeholder addresses and unstable sorting that could produce different results across validators.
MR !5012 - Advanced Swap Queue Optimization
Optimizes how swaps are indexed, matched, and processed, significantly reducing computational overhead and improving performance as trading activity increases.
MR !5125 - Advanced Swap Queue & Accounting Fixes
Limits the accumulation of failed-swap error data and fixes a validator-state caching issue that could cause inconsistencies in bond accounting.
Safer Churns & Vault MigrationsSeveral v3.21 changes come directly from real churn and migration failures observed on the network. The goal is to prevent one misconfigured node, one stuck chain, or one failed keygen from unnecessarily blocking the broader vault rotation process.
MR !5083 - Repair Vault Chain Sets From Late Keygen Reports
Allows late validator reports to add missing chains to a new vault and retries rotation once the vaults agree, fixing a real churn failure where SOL was missing from some newly generated vaults.
MR !5106 - Hold Misconfigured Nodes Out of Ready
Prevents a node that recently reported an incomplete chain configuration from immediately participating in another keygen and repeatedly stalling churn.
MR !5123 - Per-Chain Migration Progress
Stops a stuck migration on one chain from blocking every other chain in the same retiring vault, allowing healthy chains to keep draining.
MR !5118 - Preserve Keygen Retries
Prevents temporary API or Mimir lookup failures from permanently discarding a scheduled keygen retry.
MR !5177 - Faster Failed Keygen Retry
Fixes a timing edge case that caused failed keygens to wait two retry intervals instead of retrying on the first configured retry tick.
MR !5090 - AllowNoVault Becomes Operational
Makes the AllowNoVault-<CHAIN> emergency control an operational Mimir so nodes can open or close short insolvency-correction windows more quickly.
Outbound, TSS & Signing Reliabilityv3.21 also contains a broad set of fixes designed to prevent stuck outbounds, duplicate payments, TSS retry problems, and signing races.
MR !5117 - Bond Reward Accounting Fix
Caps rounded node rewards by the actual funded bond-reward balance, preventing the network from allocating more rewards than are available.
MR !5011 - Safer Vault Reassignment
Checks every observation linked to an outbound before moving it to another vault, reducing the risk of an already-paid outbound being sent a second time.
MR !5094 - Outbound Reassignment Overflow Protection
Prevents malicious or extreme transaction observations from overflowing the amount check used during vault reassignment.
MR !5136 - UTXO Keysign Recovery
Lets BTC and other UTXO chains rebuild an unsigned transaction when a TSS signing party never forms, instead of repeatedly retrying a transaction that validators disagree on.
MR !5029 - Replay-Safe TSS Failures
Ensures a completed TSS keysign-failure vote can't be replayed to repeatedly trigger slashing, jail time, vault freezing, or accounting changes.
MR !5113 - Signer Lock Race Fix
Fixes a concurrency issue that could crash Bifrost when signing workers finished while new vault and chain signing locks were being created.
MR !5093 - Signer Constants Cache Fix
Synchronizes access to shared signer configuration values, removing a race between concurrent signing processes.
MR !5081 - TSS Signer Filtering Override Becomes Operational
Makes the emergency DisableTSSSignerFiltering control an operational Mimir so it can be changed quickly when required.
MR !5131 - Better UTXO Diagnostics
Improves error reporting so operators can tell whether a vault's UTXOs are genuinely missing from the node or were simply excluded by transaction-selection rules.
Development, Security, Testing and DocumentationThe remainder of the release focuses on dependency security, monitoring, testing, simulation, and development infrastructure.
MR !5178 - Go Security Update
Updates the Go toolchain to 1.26.9 to incorporate standard-library security fixes.
MR !5140 - CosmWasm Dependency Update
Updates wasmvm and wasmd to newer maintenance releases, together with the required dependency updates.
MR !5043 - Expanded Network Monitoring
Adds 175 monitoring metrics across THORChain, giving node operators better visibility into vaults, solvency, swaps, and network health. It also addresses a potential consensus issue in telemetry.
MR !5049 - New Debugging Logs Endpoint
Introduces an optional API endpoint allowing node operators to retrieve protocol logs for specific block ranges, making network issues easier to investigate.
MR !5182 - eBifrost Data Integrity
Protects cached quorum and event data against unintended modifications, improving reliability during transaction observation and consensus processing.
MR !5104 - Shared Signer & Simulation Readiness
Strengthens the test and simulation environment used to validate XMR signing, churns, scanner recovery, and cross-chain readiness before activation.
MR !5101 - Ethereum Test Race Fix
Fixes a race in Ethereum test configuration and properly cleans up mock servers between tests. This is test-only.
MR !5095 - More Reliable Mocknet Startup
Retries temporary EVM readiness failures and prevents partially initialized genesis state from being treated as a valid mocknet deployment.
MR !5087 - Stronger CI Safety Checks
Makes several previously ineffective CI checks actually fail when problems are found, adds Bifrost race testing, and catches additional signer concurrency issues.
MR !5074 - Regression Test Reliability
Prevents the regression runner from crashing when an HTTP request fails before returning a response.
MR !5089 - Release Documentation Fix
Corrects the documented path for THORChain's changelog generation script.
MR !5061 - Incentive Pendulum Documentation Fix
Corrects the documented behavior of PendulumUseVaultAssets so it matches the actual protocol logic.
THORChain is preparing to switch Rujira back on. The protocol’s v3.21 network upgrade is designed to patch the vulnerability that froze Rujira’s App Layer in late September. If node operators sign off, trading, lending and automated trading services are expected to resume.
The fix targets block height 28,366,100. That block is estimated to land on October 23, 2026, between 13:40 and 15:20 UTC.
What broke, and what gets fixed The problem sat inside the Rujira FIN contract, part of THORChain’s App Layer. An exploit detected on September 26 allowed unauthorized transfers of a concentrated liquidity position. That position belonged to the Rujira team.
The response came fast. On September 27, 2026, the App Layer was paused in coordination with THORChain node operators. No user funds were lost in the exploit, according to the findings.
The v3.21 upgrade is the patch. Once it activates and node operators approve, the halted Rujira products are set to come back online. The upgrade also restores support for SOL and ZEC trading, limit swaps and bRUNE staking.
The grace period gamble To address that, Rujira plans to request a conditional 24-hour liquidation grace period. It would apply to credit positions with a loan-to-value ratio above 100% that face liquidation when services resume.
An LTV above 100% means the loan is now worth more than the collateral backing it. Under normal rules, those positions would be first in line for liquidation the instant the system restarts.
The proposed window gives those borrowers a day to top up collateral or unwind positions. The word “conditional” is doing real work here. The grace period is a proposal that Rujira intends to put forward, not a guarantee.
Why the restart matters THORChain’s pitch has always been native cross-chain swaps without wrapped tokens. Rujira extends that idea into a fuller app layer with trading, lending and automated strategies built on top of the base protocol.
SOL and ZEC trading broadens the assets available on the platform. Limit swaps let traders set a target price instead of taking whatever the market offers. bRUNE staking gives RUNE holders another way to put tokens to work inside the ecosystem.
What this means for users and traders Borrowers are the group with the most at stake in the first hours. Anyone holding a position above 100% LTV should treat the restart window as a deadline, not a suggestion. If the grace period is approved, it buys time. If it isn’t, liquidations could hit as soon as services resume.
Rujira caught the exploit, paused within a day, avoided user losses and shipped a targeted fix.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
THORChain has paused native Zcash swaps after a bug cut into the bonds of the operators who run its network. Onchain records show about 140 RUNE deducted from 18 node accounts.
The protocol says no user or vault funds were lost. The people who absorbed the damage were the node operators, which is roughly the outcome a bonded security model is built to deliver.
What broke, and who paid
The trouble traced back to how THORChain matches outbound ZEC transactions. An outbound transaction is the protocol sending coins back out of its vaults to a user once a swap settles, and that matching step is where the bug sat.
Something in that process went wrong, and the network treated it as a vault slash, penalizing the nodes responsible for it.
The incident occurred around October 19, 2026. The penalty came out of bonds, the RUNE that node operators lock up as collateral for the privilege of running the network.
Swappers came out clean. THORChain stated that user and vault funds were untouched, so anyone holding liquidity or trading through the protocol did not lose money because of this.
ZEC swaps will stay frozen until a fix arrives in the v3.21 network upgrade. That upgrade is expected around block height ~28,366,100, which lands on October 23, 2026.
A fresh integration hits its first snag
Native ZEC support on THORChain is very new. The liquidity pool launched on October 2, 2026, and a soft launch brought full swap functionality online by October 7-8, 2026.
So the halt arrived less than two weeks after swaps went live.
The integration supports transparent UTXOs and Zcash’s NU6.3 upgrade. Transparent UTXOs are the publicly visible side of Zcash, which works much like Bitcoin’s accounting model, as opposed to the shielded transactions that give Zcash its privacy reputation.
Instead of minting synthetic IOUs on another chain, THORChain holds real coins in decentralized vaults and moves them directly between networks, removing the bridge-and-wrapper layer that has caused so much grief across DeFi.
The second disruption this month
The ZEC halt is not THORChain’s only October headache. On October 9, Tether temporarily blacklisted approximately 1.45 million USDT spread across four of THORChain’s TRON vaults.
That freeze disrupted related swaps and liquidity provision actions for around three hours.
The two incidents have different causes. The Tether episode came from an outside issuer exercising its power to freeze funds, while the ZEC problem came from THORChain’s own code.
What this means for RUNE, ZEC, and the protocol
The most important detail for users is the one that did not happen. No user funds were lost, and the losses that did occur fell on bonded operators, which is how the system is supposed to absorb faults.
For node operators, the episode is a reminder that their bond carries real risk. A software bug, rather than malicious behavior, triggered this slash.
The things to watch are concrete. First, whether v3.21 ships around block height ~28,366,100 on October 23, 2026, as expected. Second, whether ZEC swaps come back without further slashes. Third, whether THORChain shares more detail on what went wrong in outbound matching.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
THORChain’s gross swap fees are climbing again. They are also still 84% below where they stood in September.
That gap matters because September was not a normal month. Much of its activity came from funds tied to the Bitget exploit, and THORChain now has to show what its business looks like without that windfall.
The numbers behind the spike and the slide
September’s system income reached $3.01 million. In August, it was $615,000.
Swap volume followed the same path. It hit $2.40 billion in September, up from $613 million the month before.
Most of that jump happened in five days. Between September 25 and 29, flows connected to the Bitget exploit drove the activity.
Those exploit-related flows accounted for approximately 57-63% of September’s volume and income. That works out to around $1.37 billion in swap volume and roughly $1.9 million in income during the five-day window.
As of mid-October, gross swap fees have fallen to 84% below September levels.
Fees are recovering modestly, and they are hovering somewhere in the mid-to-high six figures. DefiLlama puts recent 30-day fees at approximately $635K.
That figure sits close to August’s $615,000 in system income. The comparison is loose, since the two metrics differ, but it points to the same story: once the exploit flows disappear, THORChain looks a lot like its pre-surge self.
No significant spikes or exploits were reported in October.
How THORChain fits into this
THORChain is a decentralized liquidity protocol built for swapping assets across different blockchains. A user can move value from one chain to another without routing through a centralized exchange.
A permissionless cross-chain swap venue works for everyone, including people moving the proceeds of an exploit. The protocol earns fees on that volume, which creates an uncomfortable dynamic. One of its best months recently was powered in large part by someone else’s bad week.
Not everything in September came down to the exploit. Ecosystem participation also grew during the month.
Active wallets rose to 25,000. The validator set expanded to 103 nodes.
Protocol-Owned Liquidity, or POL, had collected nearly 946,000 RUNE in deposits by September. POL is liquidity the protocol holds itself rather than borrowing it from outside providers. RUNE is THORChain’s native token.
A new way to split the revenue
THORChain has also changed how it distributes system income. The revised split works like this:
59% to nodes
20% to Protocol-Owned Liquidity
10% to TCY
5% to the Developer Fund
5% to the Marketing Fund
1% to RUNE burn
The RUNE burn share drops from 5% to 1%. The new model shifts that money toward other priorities, with the biggest change being the 20% now going to POL.
What this means
For anyone tracking THORChain as a business, the key task is separating signal from noise. September’s $3.01 million in system income makes for a great headline. However, approximately 57-63% of that month’s volume and income came from a single, nonrecurring event.
Strip that out, and the more useful benchmark is the roughly $635K in 30-day fees reported by DefiLlama.
Steering 20% of income into POL could give THORChain deeper liquidity it controls directly. The trade-off is the smaller burn, with the RUNE burn share falling from 5% to 1%.
The figures to watch are clear enough. Track whether monthly fees can climb meaningfully above the roughly $635K range without another one-off event. Watch whether active wallets hold near 25,000 now that the surge is over. Keep an eye on how quickly POL grows beyond its nearly 946,000 RUNE.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
THORChain x Zano Podcast #242 ft. Mr_Kwibs, KentonC137 & patriotsounds | October 10, 2026 | Watch the full episode on YouTube
By Raynalytics
TL;DRZano said it is restoring gateway addresses only after an additional independent audit, following an exploit that led the project to roll back to the Hard Fork 6 point and reimburse affected users.Confidential Assets are Zano’s attempt to make amounts, addresses, and asset types private by default. $fUSD is one live example, but it is currently a third-party stablecoin with a centralized mint-and-burn point.Gateway addresses are the technical bridge between Zano’s private UTXO model and the public balance checks a future THORChain integration would need. They are not active for THORChain today.A THORChain-to-Zano swap would be publicly visible on THORChain. Privacy begins only after funds leave THORChain and move within Zano.Zano’s longer roadmap includes the Zano Execution Layer and Zenith, but the guests put the recovery audit and gateway-address return ahead of any integration timeline.IntroductionThe conversation was not a launch announcement. It was a progress report on a privacy chain that is repairing a serious failure while keeping its interoperability plans intact. Zano’s team joined Kenton and Denny to explain the exploit, the recovery approach, why $fUSD matters to the project’s Confidential Assets thesis, and why gateway addresses are the prerequisite for a future THORChain route.
The key distinction throughout the episode was status. Zano’s recovery chain is operating, reimbursements were described as nearly complete, and gateway-address code has been fixed. But the team still wants an outside audit before reactivating that capability. A Zano pool on THORChain, and any later consideration of $fUSD, remain dependent on that work.
1. Recovery Comes Before IntegrationZano’s co-founder described an exploit in its gateway-address implementation, introduced after Hard Fork 6. The team said a missing cryptographic validation let attackers exploit the system first in August and then again in September. The issue was not in the chain’s core private-transaction design, but in the gateway layer that connects a private chain to systems needing visible balances.
The response was a recovery chain beginning again from the Hard Fork 6 point, rather than accepting an inflated supply. The team said it has been reimbursing affected users with support from the development fund, personal funds, and voluntary community contributions. It also said most exchanges and services had completed the recovery process by the time of the recording.
Zano has also opened donations to its development fund. Anyone wishing to contribute can send $ZANO or $fUSD using the options in that official update.
"We are making everyone whole." (Quinten)That recovery does not mean the gateway system is being rushed back. The guests said the code is fixed, but they want a further audit from a trusted external party before setting a new activation date. Their estimate was at least two to three months for the activation process once the audit and release path begin. That was an estimate, not a delivery promise.
The sequencing matters for THORChain. Gateway addresses are the feature Zano designed to make external integrations workable. Until they return, the chain-client work cannot move from an architectural discussion to a live pool.
2. Confidential Assets Put $fUSD Inside Zano’s Privacy ModelZano positions itself as a privacy-by-default layer 1. Its core claim is broader than private balances: normal transfers conceal the amount, receiver, and asset type. That same model extends to Confidential Assets, which let builders issue assets on Zano without exposing those properties on-chain.
$fUSD, or Freedom Dollar, is the example discussed most directly. It is a third-party stablecoin built on Zano, not an asset issued by the Zano team. Quinten said it was overcollateralized with $ZANO, with roughly 6.8 million $fUSD in circulation and close to $8 million of $ZANO reserves at the time of the conversation.
The guests were clear about the trade-off in its current form. The asset is private, but minting and burning are still controlled from one wallet. The planned Zano Execution Layer could eventually support programmable lending, borrowing, and a more decentralized collateral-and-minting model. Those are aspirations for future infrastructure, not features live on the private base layer today.
"The answer is like double no." (Zano co-founder, on a blacklist function)The point was not that every application built on Zano is automatically decentralized. It was that the base chain does not provide a selective freeze or blacklist mechanism for Confidential Asset transfers. That distinction became central after the hosts discussed the temporary freezing of some TRON $USDT vaults on THORChain.
3. Gateway Addresses Are the Bridge to THORChainPrivate chains are difficult to integrate because an external protocol still needs to verify what it controls. THORChain vaults continuously check balances for solvency. Zano’s regular UTXO model deliberately hides those details, so the team designed gateway addresses as a special, more transparent account-based entry point for bridges, exchanges, and decentralized systems.
For a potential Zano chain client, that means a THORChain vault could see and verify the balance in its gateway address while ordinary Zano transfers retain the chain’s privacy properties. The guests also described a way to rotate the gateway owner key without moving all assets to a newly created address, which better matches THORChain’s recurring vault churn.
StarSquid is continuing the chain-client work once gateway addresses are restored. The teams said the remaining adjustment is compatible with THORChain’s model, but it still requires implementation and testing. No mainnet date was given.
"If you swap to Zano on THORChain, you have not achieved privacy." (Denny)That is an important boundary for readers. A THORChain swap remains public like every other THORChain swap. A user seeking Zano’s privacy properties would need to take a separate action after receiving Zano, within the Zano network itself. The prospective integration would add permissionless access to the asset, not turn THORChain into a mixer.
4. The Roadmap Separates Recovery, Speed, and ProgrammabilityThe recovery work comes first, but Zano also outlined two longer-term technical tracks. Zenith is the planned move from the current hybrid proof-of-work and proof-of-stake model to a pure proof-of-stake consensus system built on Zarcanum. The guests said they are targeting roughly 15 to 20 second blocks and five to 10 confirmations, which could reduce the current roughly 10-minute re-spend wait to about one minute or a little more.
"You can be private and fast." (Quinten)The second track is the Zano Execution Layer, or ZEL. It is intended as a separate EVM-compatible environment, linked to Zano through a threshold-signature bridge. The private base layer would remain the home for confidential transfers and assets, while programmable applications such as lending and collateralized stablecoin logic could live in the execution layer.
Neither track changes the immediate priority. Gateway addresses must return after audit before a Zano-to-THORChain integration can proceed, and the guests said the execution-layer work depends on those addresses too. The roadmap is directionally clear, but its stages are not interchangeable with a launch date.
5. Why Zano Sees THORChain as a Long-Term Access RouteThe practical case for a future Zano pool was access. Quinten said Zano had lost some routes as centralized providers changed policies and several exchanges ceased operations. The point was not a recommendation to bypass any platform’s rules. It was that access dependent on a small number of centralized services can disappear when their policies or operations change.
The team sees a permissionless THORChain pool as a more durable route, particularly because Zano is already supported by wallets such as Edge Wallet and Unstoppable Wallet. If the chain client and pool are eventually live, those wallet integrations could potentially offer Zano trading through THORChain rather than relying on a single external liquidity source.
The guests said the team and major holders would be willing to bootstrap liquidity, but that is an intention rather than a funded pool announcement. They also described a possible future $fUSD integration as an option for THORChain to consider only after Zano itself is in place.
"THORChain needs you as well." (Denny)The episode’s broader thesis was that permissionless access and private assets are complementary, but they are not the same thing. THORChain can provide an open route to a native asset. Zano can provide privacy once value is on its network. The recovery work and gateway audit are what stand between that thesis and a live integration.
What to WatchWhether Zano completes its independent gateway-address audit and announces a reactivation path without sacrificing the recovery team’s stated caution.Whether StarSquid and the THORChain team can complete, test, and review the chain-client work after gateway addresses return.Whether prospective liquidity providers formalize a Zano pool plan, including sufficient depth for a useful market rather than only a symbolic listing.Whether Zenith and the Zano Execution Layer move from architecture to tested releases, especially for faster confirmations and more decentralized stablecoin logic.Whether $fUSD becomes a candidate for further interoperability only after the underlying Zano route is operating reliably.More THORChain data, check out raynalytics.net
Follow Raynalytics for more Weekly Analytics and Podcast recaps.
Tether has reversed restrictions on four THORChain vaults on TRON, restoring access to approximately $1.45 million in USDT for users after a freeze that lasted around three hours.
The brief restriction took place on October 9 and temporarily blocked access to USDT within affected vaults on the THORChain network, disrupting a cross-chain trading route relied upon by some traders and liquidity providers. The block did not result in any loss of funds, as vault balances remained fully intact after the freeze was lifted.
THORChain, a decentralized protocol enabling cross-chain swaps, had to pause TRON trading, deposit operations, and transaction signing due to the freeze. These activities resumed soon after Tether removed the relevant addresses from its blacklist, while 19 additional addresses targeted by the same restriction remain blocked.
Chad Barraford, technical co-founder of THORChain, explained that the team received no prior communication or explanation for the freeze. Barraford stated that the protocol directly reached out to Tether during the incident, seeking clarification and expressing hope that the situation was a misunderstanding.
Chad Barraford, technical co-founder of THORChain, said the project did not receive advance warning about the USDT freeze and immediately contacted Tether for clarity, describing the resolution as a return to normal operations without broader implications for the protocol’s liquidity.
The restored access applies to only those four THORChain vaults. Other addresses blacklisted in the same operation, which remain constrained, do not benefit from this reversal. Thus, the underlying mechanism enabling centrally issued stablecoins to restrict wallet use persists for the affected wallets.
For users, the primary impact was the short-term suspension of trading and liquidity services on the THORChain protocol. The restored balances once again became accessible, ensuring platform functionality for those utilizing the unfrozen vaults.
Mini dictionary: THORChain is a decentralized liquidity protocol that facilitates cross-chain exchanges of digital assets without intermediaries, allowing users to swap cryptocurrencies directly between different blockchains such as Bitcoin, Ethereum, and TRON.
Regulatory context and Tether’s wallet controlsTether, the issuer of the largest US dollar-pegged stablecoin in circulation, maintains control over USDT at the smart contract level. The company can freeze or unfreeze specific wallet addresses, typically in response to law enforcement requests or security incidents. In December 2023, Tether announced expanded freezing policies targeting wallets linked to sanctioned individuals or suspicious activity.
The operational pause on THORChain highlighted the dependency that even decentralized projects have on actions by entities controlling major stablecoin infrastructure. Decentralized exchanges or protocols must still account for the centralized authority embedded in these tokens, which can impact continuous access to liquidity or transactional capability if an address is blacklisted.
TRON’s rising USDT supply and market impactThe interruption and restoration of $1.45 million in USDT needs to be viewed within the broader context of the expanding USDT supply on the TRON network. According to data from research firm Lookonchain, the annual increase for USDT supply on TRON amounts to $18.67 billion, bringing the total to $94.25 billion—a growth rate of roughly 24.7%.
MetricValueUSDT released (THORChain vaults)$1.45 millionTotal USDT on TRON$94.25 billionAnnual USDT supply growth on TRON$18.67 billion (24.7%)Proportion of release vs. network supply0.0015%While the vault unfreeze helped restore protocol-specific activity, the sum involved represents only a fraction—around 0.0015%—of the overall USDT liquidity on TRON. Existing tokens held in the vaults did not constitute new issuance or net inflow to the stablecoin’s total supply. The event’s significance was largely operational for platform users.
The reopening of THORChain vaults did not indicate fresh capital entering the crypto market, but simply allowed already-issued USDT to become accessible for routine trading and liquidity provision.
The dominance of USDT compared to the broader cryptocurrency market temporarily retreated from a resistance zone noted in September. Still, market observers cautioned that this metric does not reliably predict flows into other cryptocurrencies, as total supply changes can result from a variety of user behaviors including transfers, collateralization, or platform migration.
At the time of the update, the remaining 19 addresses subject to the original restriction remained frozen, and neither Tether nor THORChain publicly disclosed further details regarding the criteria or communication behind the freeze.
TLDR Tether USDT worth approximately $1.45 million became accessible after restrictions on four THORChain vaults were reversed within three hours. THORChain resumed TRON trading, deposits, and transaction signing, while 19 other addresses in the same freezing operation remained restricted. Co-founder Chad Barraford said the protocol received no advance communication explaining the freeze and sought clarification from Tether. Restoring access to existing tokens resolved an operational disruption, but it did not establish fresh capital inflows or stronger crypto demand. Tether USDT worth approximately $1.45 million became accessible again after the issuer reversed restrictions on four THORChain vaults on TRON. The reversal followed a roughly three-hour freeze on October 9, allowing disrupted network operations to resume.
The incident briefly interrupted a stablecoin route used for cross-chain trading. Reports said the four vault balances remained intact after their addresses were removed from the blacklist.
Tether USDT Restrictions Lifted as Vault Services Resume THORChain technical co-founder Chad Barraford said the project received no advance communication explaining the restrictions. Before the reversal, he said the team was seeking contact with Tether and hoped a misunderstanding caused the action.
As reported, Barraford subsequently confirmed the addresses were unfrozen and trading would resume. The publication said neither company immediately responded to its requests for further details.
The four addresses reportedly left the blacklist at 15:30 UTC. THORChain then restarted TRON trading, deposits, and transaction signing. Another 19 wallets included in the same freezing operation remained blacklisted.
That distinction limits the scope of the announcement. Tether USDT access returned for the affected protocol vaults, while restrictions continued elsewhere. The reversal did not represent a general removal of wallet controls.
For traders, the operational impact concerned whether transactions could proceed through the affected route. For liquidity providers, restored services reopened access to functions interrupted during the freeze.
The incident illustrates an external dependency for protocols using centrally issued stablecoins. Decentralized infrastructure does not remove the issuer controls attached to those tokens.
Tether USDT operates within an established framework that permits wallet restrictions. In December 2023, the issuer announced expanded secondary-market freezing measures covering wallets associated with sanctioned persons.
TRON Supply Growth Puts the Liquidity Impact in Context The wider liquidity discussion centers on TRON’s growing stablecoin supply.Lookonchain figures show an annual increase of $18.67 billion, bringing USDT supply on TRON to $94.25 billion.
Those figures imply growth of approximately 24.7%. They help explain why interruptions involving TRON can matter to traders using its stablecoin infrastructure.
However, the $1.45 million release represents approximately 0.0015% of that reported network supply. Its significance lies mainly in restoring a specific service, rather than changing marketwide buying capacity.
Tether USDT already held in the vaults remained part of the existing supply during the freeze. Removing restrictions made those balances usable again without demonstrating fresh investor deposits or new token issuance.
The USDT dominance retreated from a September resistance area near 6.7%. A lower dominance reading alone cannot confirm that holders are buying Bitcoin or altcoins.
The ratio compares the stablecoin’s market value with the broader cryptocurrency market. It can decline when other assets appreciate, even without a corresponding reduction in stablecoin holdings.
Similarly, higher stablecoin supply does not establish where holders intend to deploy their funds. Balances can support payments, transfers, collateral, or trading activity.
Any claim that Tether USDT will drive a rebound therefore requires additional evidence of actual buying. The vault reopening itself provides no measurement of subsequent Bitcoin or altcoin purchases.
At the time of reporting, the other 19 addresses remained restricted.
Is Tether’s USDT shaping up to be a rebound catalyst this cycle?
The stablecoin’s market cap is set to record its third consecutive daily increase in liquidity. However, the inflows are limited to only $310 billion, limiting risk-on sentiment.
In this context, Tether’s latest move to unfreeze $1.45 million USDT in four THORChain vaults could be sufficient to alleviate concerns about the choppy stablecoin market.
What did Tether’s USDT unfreeze change? To put the recent action into perspective, Tether had frozen four THORChain USDT vaults on the TRON blockchain, disrupting the trading and liquidity functions of the stablecoin. The initiative has been reversed three hours after the implementation, while the remaining 19 blockchain addresses have been frozen.
Source: X The key detail here is TRON’s growing role in USDT transfers.
According to Lookonchain, USDT supply on TRON increased by $18.67 billion over the past year to $94.25 billion. That represented a 24.7% increase.
With that much USDT on TRON, interruptions to liquidity operations could affect traders relying on the network. The vault freeze restricted access to $1.45 million within THORChain’s affected vaults.
Unfreezing them allowed the affected operations to resume. That eased an immediate bottleneck. Whether available liquidity would translate into fresh buying remained a separate question.
Tether’s USDT move puts key on-chain signals in focus The timing of this USDT unfreeze could not have come at a better moment.
Technicals are pointing to a risk-off move, and Bitcoin’s $80,000 level is under pressure. While the continued increase in the stablecoin’s market cap should be bullish, it has not yet led to increased demand for altcoins, evidenced by Google searches for “Buy Altcoins” being at their lowest level since 2026.
The key takeaway?
USDT dominance is retracting from the mid-September resistance level of 6.7%. This shows that the situation regarding liquidity is changing.
Investors who have been accumulating USDT may be reducing the amount of capital on the sidelines as dry powder.
Source: TradingView (USDT.D) Given this situation, it becomes clear that Tether’s decision to move USDT was not random.
By unlocking the four THORChain vaults, Tether allowed the affected liquidity operations to return to normal. This action is expected to ease the liquidity flow and reduce the friction in cross-chain transactions.
With the fall of USDT dominance and the growth of the stablecoin’s market cap, the liquidity conditions will become more suitable for the market rebound.
According to AMBCrypto, this means that the market top is not near. In turn, the fresh inflows of USDT can act as a catalyst for renewed buying if the capital rotates back into risk assets.
Final Summary Tether’s USDT unfreeze could improve liquidity and support market recovery. Rising stablecoin supply could fuel a rebound if investors return to crypto.
On-chain analyst Specter has pointed out that Arkham incorrectly tagged a THORChain wallet address as linked to the CryptoBillis Ledger hack, which caused crypto security firm PeckShield to mistakenly assert that the CryptoBillis Ledger attacker had deposited approximately $3.89 million in crypto assets to Binance over the past two days. PeckShieldAlert has responded that it will correct the related labels.
On October 9, Tether — the issuer of USDT — blacklisted four of THORChain’s USDT vaults on the TRON blockchain, freezing roughly 1.45 million USDT and halting TRON swaps before removing the addresses from the blacklist about three hours later with balances intact. THORChain co-founder Chad Barraford called the move “unprecedented in our industry” in a statement on X, and the episode has reignited a longstanding question for decentralized finance: how permissionless is a protocol when its most-used stablecoin is controlled by a single issuer?
Barraford said THORChain received no communication from Tether before the action and did not know why its vaults were targeted. “We don’t know why this choice was made and have had no comms with USDT before this action and are actively reaching out to have a conversation,” he wrote, adding that the team hoped the move “was made in error / misunderstanding.”
How the Freeze Unfolded The blacklist was executed through the addBlackList function in Tether’s TRC-20 contract on TRON, which left the affected vaults unable to send USDT. THORChain suspended TRON trading, transaction signing and liquidity-provider actions in response. Roughly three hours later the addresses came off the blacklist with balances untouched, and the protocol restored TRON swaps. Tether has not publicly explained either step.
The frozen vaults held about 1.45 million USDT — a small slice of THORChain’s overall liquidity but enough to freeze a route that users rely on for stablecoin access. The addresses appear to have been caught in a batch of freezes applied to multiple wallets rather than singled out, which may explain why the blacklist was lifted so quickly.
Issuer Control Versus Protocol Neutrality THORChain is built around removing intermediaries: users swap native assets across blockchains without wrapping tokens or handing funds to a centralized exchange. The incident shows that architecture only extends as far as the assets flowing through it. When an issuer can immobilize a token at the contract level, a protocol’s neutrality is ultimately bounded by that issuer’s patience. This is not the first time Tether has used its freeze authority — it has previously blacklisted wallets tied to sanctions cases, including ISIS-K-linked TRON wallets.
The freeze also landed amid a wider hardware-wallet theft investigation. Tether has been freezing USDT at addresses linked to reported losses from compromised Ledger devices sold by Southeast Asian reseller CryptoBilis, a case covered in BlockchainReporter’s reporting on the Ledger wallet drains. The THORChain vaults appeared to be swept up in a broader batch of freezes, though no confirmed connection has been established.
What Remains Unanswered Barraford said THORChain is actively trying to speak with Tether, but no explanation for the blacklist or its reversal has been given. That absence of clarity is itself the lesson for DeFi users: a protocol can be paused on a major route without notice, and its only immediate recourse is to say so publicly. Whether the freeze was an error, a precaution tied to a broader sweep, or something else remains unresolved.
AUTHOR
Jide Idowu is a skilled freelance writer with expertise in blockchain technology, cryptocurrency, and digital finance. Known for his ability to break down complex topics into clear, engaging content, Jide crafts articles, blog posts, and analyses that resonate with both beginners and seasoned professionals. His work spans a wide range of subjects, from emerging crypto trends to in-depth explorations of blockchain innovations. With a keen eye for detail and a passion for educating readers, Jide is a reliable voice in the rapidly evolving world of digital assets.
Tether restored access to $1.45 million in USDT across four THORChain vaults. Tron-related operations resumed after a roughly three-hour interruption. The cause remains unexplained, with 19 other addresses reportedly still blacklisted. Tether has lifted a temporary freeze on approximately 1.45 million USDT, worth about $1.45 million, held across four THORChain vaults on Tron, ending a disruption that prevented the cross-chain protocol from processing affected transactions.
The restrictions lasted roughly three hours before being reversed on October 9. THORChain subsequently restored its affected trading and liquidity operations, with no reported loss of funds.
The incident nevertheless exposed a vulnerability in decentralized trading infrastructure: a protocol can retain control of its wallets and maintain sufficient liquidity while losing the ability to transfer a centrally issued asset.
Tether has not publicly explained why the vaults were blacklisted or what prompted their release.
Four Vaults Frozen, Then Released The incident affected four of THORChain’s six Tron vaults, collectively holding approximately 1.45 million USDT.
Because the restricted addresses could not send USDT, THORChain suspended affected swaps, liquidity-provider operations and outbound signing to prevent transactions from entering routes that could not settle normally.
THORChain technical co-founder Chad Barraford reported the restrictions publicly, saying the team had received no advance warning and was attempting to contact Tether for clarification.
UPDATE: It appears @tether has unfrozen THORChain addresses. Trading/etc will resume soon
— Chad Barraford (@CBarraford) October 9, 2026
Barraford later confirmed that the addresses had been released, allowing operations to resume.
The reversal occurred around 15:30 UTC, with reported blacklist-removal events recorded within seconds of one another.
The relevant activity can be examined through the Tron USDT contract’s event records. The event feed provides a route to inspect blacklist changes, although the four individual vault transactions have not been independently matched here.
The freeze was part of a wider set of restrictions. Another 19 addresses reportedly remained blacklisted after THORChain’s vaults were released.
There is no confirmed public evidence establishing whether the protocol’s inclusion was intentional, related to a compliance investigation or the result of an administrative error.
Why Available Liquidity Could Not Settle a Swap THORChain’s architecture is designed to support exchanges between assets on different blockchains without requiring a centralized exchange to custody the transaction.
Its vault infrastructure uses threshold signature schemes, distributing transaction authorization among validators rather than giving a single operator control of the funds.
But authorization from the vault is only one requirement when the asset being transferred is USDT.
On Tron, USDT is issued through the smart contract at:
TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t The contract includes administrative blacklist functionality. When an address is restricted, the token contract can prevent outgoing USDT transfers even if the address has enough funds and its transaction is otherwise correctly signed.
Consider a user exchanging Bitcoin for 5,000 USDT through THORChain.
The user sends BTC into the swap process, and the protocol prepares an outbound USDT payment from a Tron vault.
If that vault has been blacklisted, its USDT transfer cannot complete normally. The protocol may still recognize the vault’s balance, but the balance is no longer immediately usable for settlement.
This creates a different failure scenario from a conventional liquidity shortage.
The assets have not necessarily disappeared, and the validators have not necessarily malfunctioned. Instead, the token’s transfer rules have changed for a particular address.
The operational consequences can extend beyond the value of the restricted wallet. When a vault participates in multiple transactions, losing access to its tokens can affect the availability of an entire trading route.
That makes transferability, not merely the recorded asset balance, an important measure of usable liquidity.
Can THORChain Prevent a Similar Interruption? THORChain already maintains mechanisms for suspending individual chains or specific operations during security incidents.
Its developer documentation describes controls for trading, outbound signing and liquidity-provider activity.
For example, a chain-specific trading halt prevents new swaps from being processed, while a signing halt queues outbound transactions rather than broadcasting them.
These mechanisms help contain problems without requiring a shutdown of every blockchain connected to the protocol.
The October 9 incident suggests an additional area for risk monitoring: issuer-controlled token restrictions.
A monitoring system could check whether active vault addresses have been added to a stablecoin blacklist and trigger protective measures before additional transactions are routed through them.
Four operational safeguards would be particularly relevant:
Blacklist detection: Monitor token-contract restriction events affecting active vault addresses. Route protection: Stop quoting or accepting affected swaps when the designated settlement asset cannot be transferred. User visibility: Display chain-specific restrictions and transaction delays clearly in connected wallet interfaces. Verified recovery: Confirm that token transfers are possible before reopening the affected route. These are potential safeguards, not confirmed changes to THORChain’s existing implementation.
The protocol’s current halt architecture provides a foundation for such responses, but detecting a blacklist event does not itself restore access to frozen funds.
That decision remains with the issuer.
A further complication is vault rotation. THORChain periodically changes the validator groups responsible for holding and signing transactions, meaning monitoring must account for newly activated and retiring vault addresses.
Static lists of previously used wallets would be insufficient.
What Tether’s Reversal Still Leaves Unanswered The immediate disruption has ended, but the circumstances surrounding the freeze remain unclear.
Tether’s legal terms describe circumstances in which it may restrict tokens or addresses, including compliance and legal requirements.
Those powers are part of USDT’s operating model. Their existence, however, does not establish why the four THORChain vaults were affected.
Without a public explanation, it is not possible to determine whether the restrictions reflected a compliance action, an address-identification issue or another internal decision.
The incident also raises questions about how quickly protocols can respond when an issuer changes the transfer permissions of assets held in their vaults.
For liquidity providers, the financial exposure is different from the risk of a smart contract exploit.
A token freeze may leave the nominal balance unchanged while temporarily preventing the protocol from using that balance to complete transactions.
That can affect execution, liquidity availability and the time required to process or resolve pending swaps.
The issue is not exclusive to USDT. USDC also includes issuer-controlled restrictions, while other stablecoin models carry different dependencies involving collateral, governance or underlying centralized assets.
Protocol operators therefore face a broader asset-selection problem: liquidity depth and price stability are important, but neither guarantees uninterrupted settlement.
THORChain’s October 9 recovery avoided a prolonged interruption, and the affected funds were not reported stolen. Its next operational challenge is determining whether issuer-level restrictions can be detected and isolated more quickly.
For users, the episode provides a practical reminder that decentralized custody does not necessarily mean every asset in a protocol’s vaults is beyond third-party administrative control.
Tether restored THORChain’s access to the funds. The remaining question is how reliably cross-chain protocols can settle transactions when that access can change without warning.
Alex is a financial markets journalist and co-founder of Millennial Media Group, and he's spent close to ten years trying to answer one stubborn question: what's really driving this? It started in 2016, when Bitcoin refused to make sense to him - and rather than shrug, he stayed with it until it did. That patience became his method. He's less interested in what an asset is doing today than in the plumbing behind it: how liquidity flows, where risk hides, what a chart is quietly telling you that the headline isn't. That lens eventually stretched well past crypto into traditional markets, because the same forces - fear, leverage, incentives, timing - show up everywhere once you know how to look. Most coverage, in his view, insults the reader by stopping at the surface. Price up, price down, moving on. He'd rather leave someone genuinely understanding a move than merely informed that it happened. His path into markets ran through a Tourism degree at New Bulgarian University - proof, maybe, that curiosity beats credentials. With more than 200 deep analyses and over 10,000 articles behind him, he still walks away from most trading days having learned something he didn't know that morning.
The four Tron addresses came off the USDT blacklist at 15:30 UTC with their balances intact, and THORChain has restarted Tron trading, deposits and signing. The 19 other wallets frozen in the same sweep are still blacklisted.
The four Tron addresses came off the USDT blacklist at 15:30 UTC with their balances intact, and THORChain has restarted Tron trading, deposits and signing. The 19 other wallets frozen in the same sweep are still blacklisted.
Loading this article…
Free newsletters
Good reporting. Delivered.Choose your coverage: crypto and DeFi, the future of finance, or both.
Tether has blacklisted four THORChain vault addresses on the Tron network, freezing approximately 1.45 million USDT in the process. The move, made on October 9, 2026, knocked THORChain’s Tron-based cross-chain swaps and liquidity-provider operations offline almost immediately.
According to THORChain co-founder Chad Barraford, the team received no advance communication from Tether before the freeze. One morning the vaults worked. Then they held tokens that could no longer move.
What actually got frozen THORChain is a cross-chain swap protocol. It lets users trade native assets across different blockchains, such as Bitcoin for USDT on Tron, without wrapping them or handing them to a centralized exchange.
The vaults hold the pooled assets that make those swaps possible, which is why freezing four of them stops activity cold.
With the Tron vaults blacklisted, the approximately 1.45 million USDT sitting inside them cannot be transferred. As a result, THORChain suspended Tron swaps and the related liquidity-provider functions.
THORChain currently secures around $47.9 million in total liquidity across all assets, according to recent explorer data. The frozen USDT is a small slice of that total, but it sits on a route that users rely on for stablecoin access.
Advertisement
THORChain has not yet released a full account of the incident or a timeline for restoring service. That leaves liquidity providers on the Tron side waiting to learn what happens to their positions.
How Tether can do this at all Tether’s TRC-20 contract on Tron includes a function called addBlackList. When Tether calls it on an address, that address can no longer send USDT. Similar blacklist capabilities exist in Tether’s contracts on Ethereum.
Tether uses this power regularly, frequently in response to law enforcement requests. Over its history, the company has blacklisted more than 11,000 addresses across multiple chains, immobilizing billions in value.
What makes this case different is the target. Most freezes hit wallets tied to individual bad actors. This one hit shared infrastructure belonging to a protocol that serves many users at once.
The Bitget shadow In late September, THORChain made a controversial decision not to block addresses connected to the $387.5 million Bitget hack.
The source material does not establish whether Tether’s freeze is connected to the Bitget episode. What is clear is that the order of events is uncomfortable for THORChain: first it declined to censor, then a centralized issuer froze its vaults.
What this means for THORChain and DeFi The immediate stakes fall on Tron-side liquidity providers. Their capital sits in pools that are now partly frozen, with no announced recovery plan.
For THORChain itself, the incident exposes a structural weak point. A protocol can refuse to censor at its own layer and still be censored at the asset layer. If the token you hold has an issuer with a blacklist, your neutrality only goes as far as that issuer’s patience.
USDT moves through decentralized rails, but control over whether it moves at all stays with Tether.
The things to watch now are concrete. Will THORChain release a recovery timeline for Tron swaps? Will Tether explain the basis for the freeze or reverse it?
For now, about 1.45 million USDT sits frozen in four vaults, and a protocol designed to route around gatekeepers is learning exactly where the gate is.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
On October 9, 2026, Tether blacklisted four THORChain vault addresses on the Tron network. The move froze approximately 1.45 million USDT and knocked the protocol’s Tron operations offline.
About three hours later, the blacklist was gone. THORChain got its funds back, its swaps restarted.
What happened on Tron THORChain is a protocol built for cross-chain swaps. It lets users trade assets across different blockchains without handing custody to a centralized exchange.
To pull that off, it keeps pools of assets in vaults on each supported network. Tron is one of those networks, and THORChain ran six vaults there.
Tether’s blacklist hit four of those six. Those four vaults held 93% of THORChain’s assets on Tron.
With the USDT locked in place, the protocol had to pause its Tron-based cross-chain swaps. Liquidity-provider operations on the network were halted too.
THORChain co-founder Chad Barraford said the team received no prior warning from Tether before the freeze.
Advertisement
The blacklist was lifted at 15:30 UTC the same day. Balances came back intact, and THORChain resumed trading and deposits soon after.
No hacks or thefts were reported on THORChain during the episode.
Following the incident, 19 other wallets remained blacklisted.
How Tether’s off switch works USDT is a token issued by a single company. That company built a blacklist function into the token, which lets it freeze USDT sitting at a given address.
Tether has used this function more than 11,000 times over its history, immobilizing billions in assets.
Usually, those freezes target wallets tied to scams, hacks, or sanctioned actors. This time, the target was a decentralized protocol’s operating infrastructure.
THORChain’s total liquidity across all assets sits at approximately $47.9 million, so a freeze touching approximately 1.45 million USDT is meaningful but far from existential.
The backdrop: hacks, lawsuits, and neutrality THORChain had recently decided not to block addresses linked to a $387.5 million Bitget hack.
No established connection exists between that decision and Tether’s freeze.
A lawsuit coinciding with the incident alleges Tether improperly froze $2.76 million.
What this means for DeFi and liquidity providers The most direct lesson lands on liquidity providers. Anyone supplying USDT to a protocol is also taking on issuer risk, meaning exposure to the decisions of one company, not just smart contract or market risk.
Concentrating 93% of a network’s assets in four vaults is efficient, but it also means a single blacklist action can take out nearly everything at once.
Barraford’s account that the team got no prior warning suggests protocols currently have no reliable channel to contest or even anticipate a freeze before it happens.
The pending lawsuit over the $2.76 million freeze could become a test of whether Tether faces any legal limits on how it uses that power.
What to watch next: whether Tether offers any public explanation for the freeze and reversal, what happens with the 19 wallets that stayed blacklisted, and whether THORChain changes how it holds stablecoin liquidity on Tron.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
THORChain exec accuses Tether of temporarily freezing USDT vaultsChad Barraford, technical co-founder of the network, said that the funds were frozen and then unfrozen without explanation.
THORChain technical co-founder Chad Barraford accused stablecoin issuer Tether of blacklisting the network’s USDt (USDT) vaults without explanation, then unfreezing them hours later.
In a Friday X post, Barraford said that Tether had blacklisted THORChain vault addresses, freezing about a combined 1.45 million USDT in the network’s funds across four wallets. He reported about two hours later than trading would resume after the company unfroze all the addresses.
“We don’t know why this choice was made and have had no comms with USDT before this action and are actively reaching out to have a conversation,” said Barraford before the addresses were unfrozen. “We hope that this was made in error / misunderstanding.”
Cointelegraph reached out to Tether and THORChain for details on the incident, but did not receive an immediate response.
Earlier this week, cross-border payments platform Conduit Technology filed a lawsuit against Tether, alleging that the stablecoin company froze $2.76 million worth of USDt in a wallet tied to an investigation launched by Brazilian authorities in 2024. Two Thai nationals also sued the stablecoin company in August for allegedly freezing $42.4 million in USDt after an alleged ”informal request” from US Homeland Security Investigations.
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
THORChain exec accuses Tether of temporarily freezing USDT vaultsChad Barraford, technical co-founder of the network, said that the funds were frozen and then unfrozen without explanation.
THORChain technical co-founder Chad Barraford accused stablecoin issuer Tether of blacklisting the network’s USDt (USDT) vaults without explanation, then unfreezing them hours later.
In a Friday X post, Barraford said that Tether had blacklisted THORChain vault addresses, freezing about a combined 1.45 million USDT in the network’s funds across four wallets. He reported about two hours later than trading would resume after the company unfroze all the addresses.
“We don’t know why this choice was made and have had no comms with USDT before this action and are actively reaching out to have a conversation,” said Barraford before the addresses were unfrozen. “We hope that this was made in error / misunderstanding.”
Cointelegraph reached out to Tether and THORChain for details on the incident, but did not receive an immediate response.
Earlier this week, cross-border payments platform Conduit Technology filed a lawsuit against Tether, alleging that the stablecoin company froze $2.76 million worth of USDt in a wallet tied to an investigation launched by Brazilian authorities in 2024. Two Thai nationals also sued the stablecoin company in August for allegedly freezing $42.4 million in USDt after an alleged ”informal request” from US Homeland Security Investigations.
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
On Friday, Chad Barraford, technical co-founder of THORChain, stated that Tether had blacklisted vault addresses linked to the decentralized cross-chain liquidity protocol, freezing a total of $1.45 million in USDT across four separate wallets. The funds remained inaccessible for several hours before Tether lifted the freeze and restored normal activity.
Tether’s temporary freeze on THORChain walletsBarraford, who is a key developer behind THORChain’s infrastructure, shared the developments on X, reporting that Tether acted without prior communication and did not provide an explanation for the move. He explained that THORChain’s development team was left uncertain about the reasons for the action and attempted to contact Tether directly during the incident.
“We don’t know why this choice was made and have had no comms with USDT before this action and are actively reaching out to have a conversation,” Barraford wrote on social media, prior to the unfreezing.
“We hope that this was made in error / misunderstanding.”
Trading on the affected wallets resumed within roughly two hours after the assets were unfrozen. Neither Tether nor THORChain provided further comment on the matter immediately after the incident.
Mini dictionary: THORChain is a decentralized protocol designed to facilitate cross-chain liquidity and asset swaps without requiring users to give up custody of their tokens.
Tether, the company behind the USDT stablecoin, can freeze or unfreeze assets to comply with law enforcement requests or mitigate suspicious activity, as has occurred in previous high-profile cases.
Previous freezing controversiesThis recent incident follows a pattern of similar actions involving Tether. Just days earlier, Conduit Technology, a cross-border payments platform, filed a lawsuit against the stablecoin issuer. The lawsuit alleges that Tether froze $2.76 million in USDT associated with a wallet under investigation by Brazilian authorities during 2024.
In August, two Thai nationals also initiated legal proceedings against Tether, claiming the company froze $42.4 million in USDT. According to those claims, the freeze was prompted by an “informal request” from US Homeland Security Investigations, once again highlighting Tether’s broad discretion to restrict asset movement on its platform.
IncidentDateAmount FrozenReasonTHORChain vaultsApril 2024$1.45 millionNot disclosedConduit Technology2024$2.76 millionBrazilian investigationThai nationalsAugust 2023$42.4 millionUS Homeland Security requestThe pattern of unilateral asset freezes by Tether has become a subject of concern among users and industry observers, leading to calls for clearer policy explanations and greater transparency from the stablecoin issuer.
Growing regulatory attentionTether’s practices have begun to attract the scrutiny of lawmakers and regulatory bodies. Recently, Cantor Fitzgerald, a New York-based financial services firm, faced questions from Senate Democrats regarding its business relationships with Tether, as concerns continue to build around the company’s operational transparency and compliance practices.
As legal and regulatory scrutiny intensifies, Tether’s approach to asset management and blacklisting is likely to remain in the spotlight among both industry participants and government authorities.
THORChain has a fascinating history. It has processed an awful lot of ex-hack and ex-theft money over the years. The project lied about being decentralized for years. The leader could not appear more suspicious if he tried.
So when Bitget asked THORChain to block some addresses following an attack on Bitget and THORChain refused on technical grounds THORChain was not breaking new ground. What followed was an incredible interview with a so-called "expert" packed wall-to-wall with errors. And some technical commentary that made far more nuanced, less damning and far harder to adjudicate points. This measured commentary was also far less consequential in that the claims were not of any sort of grand illegality. They sat in stark contrast to the high profile interview riddled with problems. And most of the public chatter here is either unreasonably negative on THORChain but short on accuracy, or unreasonably positive on THORChain and also short on accuracy.
We are going to try to untangle this mess. The real story, in our view, has three essential plot points. First up: yes, THORChain was completely centralized and the team lied about this for years. Almost surely crimes were committed, even if only of the generic "unlicensed money transmission" flavour that nobody seems to care about anymore. We will sketch this a little bit below but, really, this is old news and not relevant to current activities. The team put themselves in a bad spot by lying for years.
Second: THORChain is not run by the best imaginable group of software engineers and their procedures and such look a bit sloppy. They also have a long history of security problems and some of the way they deal with their own shortcomings – they absolutely have a solid history of building defective software! – is less than ideal. This is a problem across web3 and in our view the THORChain team are no less competent than their self-described "expert" critics.
And third: the attacks on THORChain's current operation are mostly borne of ignorance, built atop falsehoods and misrepresentations, and fail to recognize that applying the same standards to other projects is to call many many large services outlaw. As we will see, if THORChain's current setup is outlaw then surely a large number of other large projects are too.
So here is a story of people that live in glass houses and seem to want to start a stone-throwing fight.
HistoryFor years THORChain had central admin keys that held pretty much arbitrary control over the platform. We published a relatively detailed technical piece in September 2024 working through much of this. To us this was old news at that time. Many of the code changes linked in that piece date to 2020 and 2021. All of that code was, and remains, public. The team lied in English about decentralization but the code was always out there.
We were not the only people to know about this of course. But it does look like nobody else ever bothered to publish an explanation that a half-technical person could actually follow.
Then in February 2025, shortly before the ByBit hack, THORChain announced it was removing these admin controls. That was an admission of sorts that they had always existed and that many accusations the platform was not decentralized were in fact correct.
Reasonable people can disagree over how long following this change it took for the admin controls to properly disappear. The THORChain network runs in epochs with governance processes that extend far longer than a single block. So this is not exactly like a Bitcoin change. And it is not even like a change to Ethereum staking or finality where 10s or 100s of blocks across minutes to maybe hours are sufficient to be sure the change has fully cleared. But this was initiated in February 2025 and was certainly well finished long before, many months before, 2026 began.
So none of the technical features of THORChain's centralized admin were relevant in September 2026. Claiming these things – which absolutely did exist for years – are relevant in a technical discussion of Bitget's request to THORChain is to admit you do not know what you are talking about. Do these prior bad acts maybe help establish a pattern of dishonesty? Sure. And it is reasonable to question if the team is lying now because the team was lying back then. But it is wrong to take proof of past lies as proof current statements are also untrue.
Current SetupTHORChain as of now is an odd system. It is sometimes accused of being a mixer. But it is not a mixer. It does not do a good job at obfuscating flows. Yes the recordkeeping is a bit messy and things could be more accessible. But all the transactions are visible and nothing like a mixer sits in the mix.
What THORChain actually provides is distance, not obfuscation. THORChain is effective for money laundering for two reasons. First, it allows transactions directly to Bitcoin where flows can then be mixed fairly easily. And second, large exchanges accept deposits from THORChain as clean in ways which frankly baffle us.
We discussed this in the New York Times in November 2025. A huge amount of ETH from the ByBit hack poured straight into THORChain. The hackers swapped to BTC and whoever they were trading with kept depositing those ETH to Binance. Presumably the hackers' trading counterparty was swapping those ETH back to BTC to reload THORChain. And round and round it went. It was easy to see this in real-time.
Binance accepted the ETH deposits from THORChain because...yeah we do not know why. As we told the New York Times "Even a bad — maybe even defective — screening tool would spot" that these were hack proceeds. But THORChain is a "legit" service and web3 does not have a problem with fund provenance from services with bad reputations so long as they are not actually mixers. Or at least that was the case in early 2025. Is it still true? We do not know. THORChain still is not a mixer but maybe some services will stop accepting inflows from there. Who knows.
Anyway, as of now THORChain is as decentralized as many other services. We will go through a bit of that shortly. But first it is worth looking at a few of the technical claims about the current setup that have been made to explore how false they are.
The Confused "Expert"First, we have an "expert" claiming THORChain is a closed-source permissioned project based on this chat excerpt:
https://x.com/tayvano_/status/2105515560935239710Important context here is that Dinosauruss is asserted to be an attacker that eventually joined THORChain as a node operator and successfully attacked the protocol. The chat transcript shows someone struggling to successfully join the network and asking for help on a Discord channel. This was interpreted as follows:
he was unable to churn in actually 😂 😂he tried for weeks and then he had to.......join the discordthats how you have his discord handle and id and know its himhe had to go into discord and share his addresses and info and beg to be let into the super secret room to get the real client codelmao lol hahahahhahahahaWe will take this line-by-line because it is important. The processing of "churn in" is how THORChain rotates node operators. Then we find a claim it took weeks to get the software working so they could churn in. And that they joined some Discord chats to ask for help and in fact some some help.
Finally, the claim is that this user was unable to join the network until they were allowed into a "super secret room" to get "the real client code."
If true that would be a problem. If you can only join a network by getting access to secret source code then it is not an open network. But this claim is not really true. Yes, THORChain has some odd embargo processes around security problems. But let's look at an actual release, v3.18.0, with code published May 9th, where the discussion above occurred just days before this release:
Given the dates this is the upcoming release discussed in the screenshot above.The release shipped as private binary, with the code to build the release made available at latest by May 9th and an expected production release date of May 12th. Does that mean only certain people could see the "security patches" while they were being developed? For at least some of the time yes it sure does. Does that mean less than 100% of development was done in the open? It sure does. But the code was released before production deployment. All code sits on the developers computer for some period of time before it hits the public. What matters is if the code is public before it gets put into production.
It is simply false that having some kind of security embargo policy renders your project closed-source. We need only present the Linux kernel Embargoed hardware issues policy to prove this beyond all doubt. If your definition of open source excludes Linux then your definition is wrong. So security embargoes and limited periods of non-public code development are accepted. This is not even a situation where the code was released post-deployment. Yes it was not available pre-deployment for as long as it could possibly have been available but that is a far cry from a process where one must "beg to be let into the super secret room to get the real client code."
Yes there is a little bit of complexity around the a library that does some of THORChain's internally developed cryptography. A small bit of code is, the team claims temporarily, not open source because it is security-critical and has had a lot of vulnerability problems. As discussed elsewhere in this column there are small closed-source components to many large web3 systems. And given the track record of bad security software development at THORChain the team does not have a lot of good options with respect to their vulnerable cryptography software. We view this as a minor mark against the team and anyway nothing worse than examples provided below. Once the team made the bad decision to roll their own cryptography the die was cast for problems in the general vicinity.
Now, if somebody wants to claim that web3 projects are only entitled to exemptions from various financial regulations when 100% of development is done in public they are certainly welcome to do so. But this is not only a bar far higher than that accepted by the software industry in general – it is a bar that will exclude nearly everything in web3 production use today. The expert we are addressing here works at MetaMask and as we have documented before parts of MetaMask are not open source and have been closed for years while used in production.
GoPlus's Soft Claimsweb3 security firm GoPlus published a piece claiming THORChain has never been strictly decentralized. The first clue this might be a weak argument is the use of "strictly." They did not even decide to lead with some clickbit but already took a soft position. We applaud GoPlus for being honest. And we also want to throw a little shade in their direction for making a noisy entrance without much real content.
The strictest definition of a decentralized protocol we can think of is that it is impossible for anyone to identify a sufficiently large group of participants such that it would be possible to compel the group to make changes to the protocol. In this "strict" sense Bitcoin is not decentralized because we can easily identify enough pool operators to pass 51% of the network and someone could, for example, visit their offices.
Would it be easy to force them to make some changes which are likely bad for Bitcoin? Who knows. But "strictly" can reasonably be interpreted to mean "can we get these changes put through if bring guns to a bunch of pool operators' offices and threaten to shoot them?" And then the answer is "yes." Now this would swap unlicensed money transmission for something a bit harder as the crime of interest but, again, GoPlus said "strictly." If "wrench attacks" are considered a reasonable threat model for securing self-custody then they are surely also a reasonable threat model for strict decentralization.
Most of GoPlus' specific complaints, numbered 2 through 5, all amount to "there is a smallish group that can collude to make arbitrary changes to THORChain." This is true and true of nearly every web3 project. We are not going to debate whether large mining pools render Bitcoin centralized – we are just going to say that using "strictly" as a weasel word here is a sign they know the argument is weak. Every product with a security council has this problem. In some sense everything with a multisig has this problem.
But GoPlus' first claim that "TSS vaults ≠ base-layer consensus" is worth discussing. THORChain uses a different architecture than many bridges and L2s and other things which connect blockchains to other blockchains. The Threshold Signature Scheme (TSS) used by THORChain is odd. Roughly speaking, funds within the THOR ecosystem sit within multisigs where some threshold of "validators" needs to approve outflows. GoPlus claims this is not the same as a "base layer consensus" scheme where the blockchain itself validates individual signatures and all you need to move assets is your own private key on top of a working blockchain. But validators sign blocks as produced, and blocks as produced include user transctions. Without block production transactions do not flow.
For an L1 there is a real difference in form here even if not in function. But for an L2 or a bridge or anything in that general area this is really no different than something like an odd sequencer design. A sole sequencer in an L2 is just a TSS where the threshold is the one sequencer. If you have some more distributed scheme then it is just a TSS where the T is however many parties need to approve a transaction or withdrawal. We will talk about Hyperliquid a bit below but suffice it to say Hyperliquid can be thought of as a dumb TSS too.
Now for an L1 or an L2 or a bridge is there a substantive difference between the validators having the collective ability to block or censor transactions vs a TSS where some quorum of validators need to actively approve (certain kinds of) transactions? If there is a difference it is small. But even acknowledging this is a legitimate question is to acknowledge Arbitrum, base, Hyperliquid, Polygon, Starknet and many many other projects are less decentralized than THORChain. Why? Because participating in the THORChain validation process is less gated than joining a security council or having a team-controlled emergency multisig.
Certainly THORChain is more decentralized than any of those things. There are complaints that THORChain's 100-ish nodes are really operated by only 10s of people. Maybe. Maybe not. Arbitrum froze funds using a 9-of-12 multisig. If your histrionic moaning does not even claim a T below 9 for the TSS yet you defend the Arbitrum action what are you even doing?
If anyone wants to take the position current THORChain is "clearly" an illegal custodial scheme they are arguing a huge swathe of web3 is also outlaw. We have a lot of sympathy for the last point there. A lot of the products named in the preceding paragraph, and others to boot, are in our view obviously illegal custodial schemes. And that can be true with current THORChain sitting on either side of the line. Be careful what you wish for.
ComparisonsThe best two comparisons here to show that current THORChain is not too bad are base and Hyperliquid. Is this a relativist argument? Yes. We are arguing that anyone that wants to paint current THORChain as completely beyond the pale must take the same position with respect to many other projects to reveal themselves to be a hypocrite. We expect the later to be the real explanation. But for now we will just focus on facts.
baseWe first wrote in August 2023 about base looking like a centralized, custodial system. We wrote a follow-up in July 2026 noting that essentially no progress had been made and the project's public comments over the interim 3 years admitted all our claims were true.
base's problem is that Coinbase controls all the levers and all the money. And Coinbase-controlled infrastructure not only holds all the funds in its sole custody and control, but Coinbase has actively rolled back the chain to address problems before and otherwise used its absolute central authority. Industry coverage generally acknowledges base is just a custodial service run by Coinbase with a bit of gratuitous software on top.
And the entire thing is built around a sole sequencer that needs to keep pushing out messages for bridging transactions to Ethereum to work. Yes, there are mechanisms to work around the Coinbase-operated infrastructure. But that infrastructure can also upgrade the code instantly at any time and take all the funds for itself if it wants. Coinbase has more power over base than the THORChain developers do over THORChain. It is not even close.
In THORChain the risk is the TSS does not give you your funds because the T is not met. In base the risk is that Coinbase decides it wants your money. Those are not identical but they sure are fairly similar. THORChain is, in our view, better.
HyperliquidThis one looks remarkably like THORChain only worse and more extreme. Hyperliquid takes the possible issues and oddities with THORChain and replaces them with clearly-out-of-bounds simplifications. To get your money off Hyperliquid one of the designated system validator addresses needs to approve your withdrawal through a two-step process. This is a TSS. And as discussed at that link it is a TSS gated by a permissioned set of validators.
And it gets much worse. THORChain may have some embargo issues and the processes for sharing code may not be ideal. But Hyperliquid is just straight-up closed source. There is no debate on this point: Hyperliquid's code is not available to the public.
THORChain also has some kind of strange on-chain governance processes where parameters can be changed and votes are taken and the like. We are not going to get too deeply into the details here because what really matters for the comparison is that Hyperliquid's on-chain governance is supposed to be mediated by a dispute resolution process. But that process is restricted to the team itself and approved participants. So external parties simply cannot participate at all. Again, THORChain's wonky and not-perfect schemes are clearly more open than Hyperliquid's smoke filled back room. The schemes are not even close.
One of the core complaints about THORChain quoted above, once corrected for clear errors and false statements, is that it is awfully difficult for external parties to follow along and participate because the code is often released with little notice and the system is fiddly to run. Those are real gripes and fair enough. But they are qualitatively different from a system that simply does not allow external participation at all and does not publish source code at all.
DiscussionTHORChain has a long history of misrepresenting how it works and processing funds straight out of hacks and thefts. THORChain has a lot issues. The THORChain team almost surely has open legal liability.
But that does not mean every complaint about THORChain today is accurate or reasonable. And it certainly does not mean current THORChain is a particularly outlaw product. This is not an effort to defend THORChain or apologize for past bad deeds by the team. It is just being honest about what is happening today. Does doing better today excuse past bad conduct? Not really. But again, it is only fair to attack the team for what they actually did not what you dreamed up they are still doing.
When compared against a lot of major, respected, services today current THORChain looks pretty good. This is maybe 50% because THORChain has improved a lot and 50% because a huge fraction of current services are also misrepresenting the degree to which they remain outlaw. Maybe that should be 60/40 or 20/80 or some other mix. Maybe you view the mix differently. But there is clearly a large measure of both components at play here.
Today THORChain and the team behind the project are in kind of a tough spot because of their past behaviour. Admitting you did lots of crimes before but changed the system as a way of defending against allegations you are criming today...that has obvious problems as a defense strategy.
But we really do not see that they have any choice. THORChain's best course of action is to compare the functionality of the system today and in the past to other more-respected systems with similar problems. There are only two ways the THORChain team avoids law enforcement: staying below the radar or looking like they were doing the best they could and hoping the high level plan is not to arrest everybody. If the plan is to arrest everybody they are already screwed. And staying below the radar screen has not been a viable strategy for some time. Our advice to the THORChain team is based on the simple premise that you must play the cards you are dealt.
So honestly and openly describing how THORChain is of a piece with many other web3 products out there is just about all they can do. We hope they make an effort in this direction primarily because – full disclosure here – it will be very amusing to watch people squirm. Will this likely involve making statements about illegal behaviour by other large projects which are generally considered to be good actors? Yes it will. Is that good for "web3" as a whole? Who knows. But the rest of the ecosystem brought this on themselves by accepting funds out of THORChain when it was clearly an outlaw service and then turning around and unfairly attacking it for things it did not do. Game on then it would seem.
North Korea-linked operators use cross-chain swaps, decentralized exchanges and professional intermediaries to move stolen cryptocurrency. THORChain played a documented role in processing assets associated with the 2025 Bybit theft, illustrating how legitimate liquidity infrastructure can be exploited. OTC brokers and informal settlement networks create financial relationships that are not fully visible through blockchain transaction records. North Korean hacking groups have turned cryptocurrency theft into a sophisticated financial operation, relying on cross-chain infrastructure, professional money launderers and informal payment networks to move assets beyond the reach of exchanges and law enforcement.
The scale of the problem became particularly visible after the $1.46 billion Bybit theft in February 2025. The FBI attributed the attack to North Korea’s TraderTraitor activity, while subsequent blockchain investigations documented the rapid movement of stolen Ether through thousands of transactions.
More recent reporting by Wu Blockchain has drawn attention to the intermediaries operating between the initial theft and the eventual use of stolen funds. These networks can exchange assets, supply liquidity and arrange settlement without requiring the original attackers to manage every transaction.
The result is a laundering ecosystem in which the technical compromise of a cryptocurrency platform and the financial processing of stolen assets may be handled by different participants.
How the Bybit Hack Exposed Cross-Chain Laundering The Bybit incident began with a compromise of the exchange’s Ethereum cold-wallet signing process. Attackers manipulated the transaction approval workflow, allowing assets to be transferred to unauthorized addresses.
After the theft, the attackers moved large quantities of Ether through intermediary wallets and cross-chain services.
One of the most closely examined services was THORChain, a decentralized liquidity protocol that enables native cryptocurrency swaps between supported blockchains.
Unlike a centralized exchange, a cross-chain liquidity protocol can facilitate asset conversion without relying on a conventional customer account.
In the Bybit case, blockchain investigators reported substantial flows through THORChain as stolen Ether was converted into Bitcoin and other assets.
The mechanism matters because a conversion from ETH to BTC changes the environment in which investigators must follow the funds.
Ethereum’s account-based transaction model and Bitcoin’s unspent transaction output model record transfers differently. Following a cross-chain swap therefore requires investigators to associate an incoming transaction on one network with an outgoing transaction on another.
That association may be possible using transaction timing, amounts, protocol events and other observable evidence, but it is more complicated than tracing transfers between addresses on the same blockchain.
Cross-chain services are not inherently illicit. They also support legitimate trading and liquidity management. Their relevance to money laundering comes from the ability to exchange assets across networks, particularly when access does not involve conventional identity verification.
The Bybit investigation demonstrated that stolen cryptocurrency can be moved through widely used decentralized infrastructure without compromising that infrastructure itself.
The Professional Launderers Behind the Transactions Blockchain movements reveal where assets travel. They provide a less complete picture of the commercial relationships behind those transfers.
North Korea-linked operations have been associated with intermediaries that exchange suspicious cryptocurrency for other assets, arrange transfers through OTC channels or facilitate payments through networks outside conventional banking.
Some laundering services operate as brokers rather than simple exchange platforms.
An intermediary may accept cryptocurrency associated with a theft and arrange to provide the client with different assets or value through another settlement channel, retaining a fee or discount.
That arrangement can transfer part of the operational risk from the original thief to a separate financial facilitator.
It also complicates efforts to establish the amount ultimately available to the attackers.
For example, Elliptic reported that approximately $200 million connected to the Bybit theft moved through the eXch cryptocurrency exchange service. The figure describes activity attributed to that service, not a verified cash payment to the attackers.
Investigators therefore distinguish between three measures: the value originally stolen, the volume processed through laundering services and the proceeds ultimately obtained by the perpetrators.
Only the first two can sometimes be estimated directly from publicly observable blockchain activity.
A broader investigation by 38 North has examined the role of financial facilitators and OTC brokers in helping North Korean actors convert cryptocurrency into usable resources.
Those intermediaries are significant because they can connect digital-asset transactions to commercial payments, local-currency liquidity or other financial arrangements that blockchain records alone cannot fully reveal.
From Stolen Tokens to Usable Value The laundering process does not follow a single fixed route. Assets may pass through different services, return to earlier networks or remain in cryptocurrency rather than being converted into fiat.
The following sequence illustrates the principal stages investigators examine. It is a generalized model, not a verified transaction path for every North Korean theft.
CRYPTO CRIME / MONEY FLOW
How Stolen Crypto Moves Through Laundering Networks
A simplified view of the financial infrastructure used to process stolen digital assets.
01
The Initial Theft
Attackers compromise an exchange or wallet and transfer cryptocurrency to addresses under their control.
ENTRY POINT
↓
02
Swaps and Chain-Hopping
Assets move between wallets, liquidity protocols and blockchains, changing their form and complicating transaction tracing.
ONCHAIN MOVEMENT
↓
03
Professional Intermediaries
OTC brokers and financial facilitators exchange assets or arrange settlement through separate financial channels.
LIQUIDITY & SETTLEMENT
↓
04
Usable Financial Value
Proceeds may emerge as fiat currency, commercial payments or cryptocurrency retained for later use.
FINAL ECONOMIC USE
Methodology: Illustrative sequence based on laundering patterns documented in investigations by the FBI, Elliptic and 38 North. Individual cases may involve different routes, additional intermediaries or repeated stages.
Where Investigators Can Interrupt the Flow The earliest stages of laundering offer opportunities for exchanges and blockchain analytics firms to identify suspicious movements before assets reach intermediaries.
The FBI’s February 2025 advisory on the Bybit theft provided addresses associated with TraderTraitor and urged exchanges, bridges, decentralized finance services and other virtual-asset providers to block transactions involving identified stolen funds.
For compliance teams, that requires more than screening a recipient address against a static sanctions list.
Transaction monitoring should incorporate exposure to known thefts across multiple blockchains. A newly created wallet may have no direct sanctions designation but could receive assets shortly after they pass through a cross-chain swap associated with a confirmed exploit.
Such connections require careful interpretation. Indirect exposure alone does not establish that the recipient knowingly participated in money laundering.
Liquidity providers and exchanges can also monitor unusual transaction patterns, including rapid conversions, fragmented transfers and activity involving addresses recently associated with a security incident.
When suspicious assets reach a centralized platform, investigators may have an opportunity to preserve records, identify account holders and request restrictions through appropriate legal procedures.
The Bybit response provides a documented example. According to the exchange’s incident timeline, industry participants helped freeze approximately $42.89 million in exploited funds by February 23, 2025.
For stablecoins with issuer-controlled freezing functionality, timely coordination with issuers may provide another intervention point. Native Bitcoin and Ether do not offer an equivalent centralized freezing mechanism.
The final stage requires a different investigative approach.
OTC brokers and informal financial facilitators may connect cryptocurrency transfers to bank accounts, cash movements or trade settlements. Detecting those relationships can require suspicious activity reports, financial intelligence, customer records and cooperation across jurisdictions.
Research published by 38 North in March 2026 identified examples involving facilitators operating across several countries and argued that authorities should devote greater attention to cash-out networks, not only the hackers responsible for the initial theft.
Why Cash-Out Networks Matter More Than Another Wallet Address North Korea’s cryptocurrency operations expose a limitation of blockchain transparency: public transaction records can document the movement of assets without identifying every financial relationship behind them.
The distinction becomes especially consequential when professional intermediaries purchase stolen cryptocurrency at a discount or arrange settlement through separate payment networks.
Investigators may know which service received the assets while lacking evidence of the final payment or its recipient.
In some cases, conversion into conventional currency may not be necessary. Research on North Korean sanctions evasion has documented efforts to use cryptocurrency directly in commercial transactions, potentially reducing dependence on conventional cash-out channels.
This shifts part of the investigative focus from cryptocurrency exchanges to the wider financial and commercial networks through which illicit proceeds acquire economic value.
The latest Bitget case remains relevant to that work. Wu Blockchain reported that the exchange revised the assets involved in its September incident to approximately $387.5 million, while North Korean attribution had not been conclusively established in a published technical investigation.
Until additional evidence becomes available, conclusions about the precise perpetrators and their eventual proceeds should remain qualified.
The Bybit case provides stronger attribution, supported by the FBI, and a more developed public record of subsequent laundering activity.
Together, the investigations illustrate why stopping cryptocurrency theft proceeds requires two distinct capabilities: following assets across networks and identifying the people or institutions willing to convert those assets into usable value.
The first is increasingly supported by blockchain analytics. The second depends on financial intelligence, enforceable compliance controls and international cooperation.
Alexander Zdravkov is a crypto journalist and market analyst specializing in digital assets, blockchain technology, and the rapidly evolving cryptocurrency market. He entered the industry more than four years ago, drawn to the speed of innovation in crypto and the potential of blockchain-based financial systems to reshape traditional markets. His work focuses on understanding the forces behind crypto market movements, from Bitcoin and altcoin cycles to institutional adoption, regulation, exchange-traded products, stablecoins, DeFi, and emerging blockchain ecosystems. Rather than simply following price action, Alexander looks at liquidity, investor positioning, market structure, and macroeconomic conditions to identify developing trends and explain what they could mean for digital assets. With a degree in International Relations, he brings a broader perspective to cryptocurrency coverage by connecting developments in the sector with monetary policy, geopolitics, regulation, and global capital flows. This allows him to examine crypto not as an isolated market, but as an increasingly interconnected part of the global financial system. Over the course of more than five years in financial journalism, Alexander has written over 5,000 articles covering cryptocurrencies, blockchain, traditional markets, and the global economy. His reporting spans Bitcoin, Ethereum and altcoins, DeFi protocols, institutional crypto adoption, regulation, market infrastructure, security incidents, and major developments shaping the wider digital asset industry. His approach is centered on giving readers context behind the numbers and headlines, explaining not only what is happening in crypto markets, but why it matters and what could come next.
George Town, , October 8, 2026 —, Cayman Islands, October 8th, 2026, Chainwire
THORChain, a decentralized exchange, announced that native Zcash (ZEC) swaps are now live, allowing users to exchange ZEC with assets across other supported blockchain networks without relying on wrapped tokens or a centralized exchange.
The launch follows THORChain update 3.20, which introduced support for Zcash and Monero to the protocol. The Zcash pool currently holds more than $50,000 in liquidity, allowing the network to begin processing live ZEC swaps.
The pool remains in a soft-launch phase while performance is monitored. Trading may be temporarily paused if bugs or other issues need to be addressed. The current pool size can easily support trades in the five-figure range, however larger trades will experience higher slippage and take longer to settle until liquidity grows in the pool.
Protocol-Owned Liquidity (POL) will be automatically added to the Zcash pool when the fees/depth ratio is high enough. POL, introduced as part of the 3.20 upgrade, gives the protocol a mechanism to deploy a portion of the liquidity fees (currently set at 20%) into supported liquidity pools. As more liquidity enters the ZEC pool, it will be better equipped to support larger swaps with lower price impact and faster execution.
The integration gives Zcash holders a direct route into the broader crypto market using native assets. Users can swap ZEC against supported assets including Bitcoin (BTC), Ethereum (ETH), and stablecoins without needing to deposit their Zcash with a centralized custodian or convert it into a wrapped representation on another network.
Zcash adds another native blockchain to THORChain’s cross-chain liquidity network, bringing the total to 14 blockchains. Rather than move assets through bridges or require users to give up custody to trade between otherwise disconnected networks, THORChain settles swaps using the native assets on their respective chains.
The soft launch will allow the network to test Zcash swaps under real market conditions while liquidity develops. The Zcash pool and its current liquidity can be tracked here.
About THORChain THORChain is a decentralized exchange (DEX) that enables users to swap native digital assets across different blockchain networks without relying on wrapped assets or centralized custodians. It allows users to exchange assets including Bitcoin, Ethereum, and other supported cryptocurrencies while maintaining a self-custodial experience.
Protocol upgrades, new chain integrations, ecosystem developments, technical discussions, frontend updates and community conversations can all happen within the same week.
With that much activity, keeping up gets hard, especially if you aren't active across X, Telegram or Discord every day.
The good news is that you don't have to follow everything.
THORChain communicates across multiple channels and formats, so you can choose how closely you follow the protocol and how you prefer to consume information.
🎙️ THORChain Podcasts: Protocol & Ecosystem UpdatesTHORChain hosts regular podcasts covering the latest developments across the protocol and ecosystem.
THORChain Podcast | Protocol Update (Thursdays)
Featuring Chad, this podcast covers protocol updates, integrations, network developments, new features and other developments across THORChain.
Longtime community members may recognize this Thursday series by its nickname, THORSday.
THORChain Podcast | Ecosystem & Community Spotlight (Saturdays)
This series focuses on the broader THORChain ecosystem, highlighting projects, contributors, community developments and discussions from across the network.
You can join the podcasts live, watch the replays, listen to audio episodes or catch up through written recaps.
🔴 Watch LiveBoth podcasts stream live. Join the audience on Riverside to watch the discussion and write in the chat while it happens.
📺 Watch the ReplaysMissed the live? Replays of Protocol Update and Ecosystem & Community Spotlight are available on the THORChain Community YouTube channel.
📝 ReadDon't have time to watch or listen to the full discussion?
Written podcast recaps summarize the topics, developments and takeaways from recent episodes.
THORChain Blog:
https://blog.thorchain.org/
📰 THORChain Blog: Data, ADRs and ExplainersThe blog goes well beyond podcast recaps. It's where THORChain publishes its long-form content:
• Monthly State of the Network reports with on-chain data
• ADR explainers breaking down the proposals that change the protocol
• Protocol upgrade and new chain integration articles
• Guides and protocol explainers
• Ecosystem updates, quarterly reports and community spotlights
If you want the numbers and the reasoning behind THORChain's decisions, this is where to read them.
THORChain Blog:
https://blog.thorchain.org/
📩 THORChain Weekly NewsletterIf you don't want to monitor multiple platforms, THORChain also publishes a weekly email newsletter every Wednesday.
It brings together the week's developments and content from across the THORChain ecosystem, so you can stay informed without following every conversation.
Subscribe to the THORChain Weekly Newsletter
📢 Telegram Announcements: Key UpdatesPrefer receiving protocol and network updates through Telegram? The THORChain announcement channel brings announcements from across THORChain's communication channels directly to Telegram.
THORChain Announcements:
https://t.me/thorchain
💬 Telegram Community: Discussions and QuestionsWant to participate rather than just follow updates?
Telegram is where the THORChain community thrives. It's home to the day-to-day THORChain conversation, where users, contributors and community members discuss developments, ask questions, share feedback and follow what's happening across the ecosystem.
THORChain Community:
https://t.me/thorchain_org
These conversations matter. Some of THORChain's features started as ideas raised by community members.
💻 Developer Discord: Go DeeperFor developers, node operators and technically inclined community members, the THORChain Developer Discord provides a place for deeper technical and network-related discussions.
Topics include:
• Protocol updates
• Technical discussions and questions
• Architecture Decision Records (ADRs)
• Network and node-related discussions
• Development activity
• Technical troubleshooting and support when relevant
#thornode-mainnet
The #thornode-mainnet channel is where mainnet and network updates for node operators get posted. Follow it if you want to stay close to THORChain's technical and operational activity.
If you're looking for deeper technical context behind protocol development and network activity, this is the place to follow.
𝕏 Follow THORChain in Real TimeFor shorter updates, announcements, educational content and ongoing discussions from across the ecosystem, follow THORChain on X.
THORChain on X:
https://x.com/THORChain
X provides one of the easiest ways to follow THORChain developments while also participating in the broader Crypto Twitter conversation.
📱 THORChain Across Social MediaTHORChain is also expanding its presence beyond Crypto Twitter.
Content from podcasts, blogs and other THORChain communications is repurposed across platforms so you can follow the protocol wherever you already spend your time.
You can also find THORChain on:
LinkedIn: https://www.linkedin.com/company/thorchain
Institutional, educational and professional content, alongside major THORChain updates.
Facebook: https://www.facebook.com/THORChain/
Protocol content, blog articles, podcast clips and livestreams.
Instagram: https://www.instagram.com/thorchain
Short-form video and podcast clips designed for quick consumption.
TikTok: https://www.tiktok.com/@thorchaincontact
Short-form educational and podcast content.
Reddit: https://www.reddit.com/r/THORChain/
Community discussions, educational content and redistributed THORChain updates.
🔄 One Protocol, Different Ways to Stay InformedChoose the format and level of detail that works best for you.
Want the weekly highlights?
→ Subscribe to the Weekly Newsletter.
Want deeper context behind protocol and ecosystem developments?
→ Follow the THORChain podcasts, including Protocol Update and Ecosystem & Community Spotlight.
Prefer reading?
→ Read the Podcast Recaps and THORChain Blog.
Want protocol updates delivered through Telegram?
→ Follow the Telegram Announcement channel.
Want shorter updates and Crypto Twitter discussions?
→ Follow THORChain on X.
Want to join the day-to-day THORChain conversation?
→ Join the Telegram Community.
Want technical discussions, network updates, ADRs and developer conversations?
→ Join the THORChain Developer Discord.
Prefer short-form video or other social platforms?
→ Follow THORChain on Instagram, TikTok, Facebook, LinkedIn or Reddit.
Staying Informed Is Just the BeginningTHORChain isn't only about following announcements and protocol developments. It's also about participating in the conversations happening across the ecosystem.
Community members can ask questions, share feedback, discuss ideas and contribute to ongoing conversations through Telegram, Discord and other community channels.
These discussions can help surface new ideas, identify areas for improvement and contribute to the protocol's ongoing development.
Whether you're a developer, node operator or simply someone interested in cross-chain DeFi, there are ways to get involved.
Staying informed is the first step. On THORChain, you can also take part.
ZEC has been around since 2016, but its presence across DeFi has remained limited. Users have had relatively few ways to access permissionless liquidity or swap ZEC into assets on other chains without relying on centralized exchanges, bridges, or other third parties.
That’s about to change.
THORChain has completed its ZEC integration, bringing native Zcash into its cross-chain infrastructure. This allows users to swap ZEC directly with native assets on other supported chains without first wrapping or bridging it.
And with ZEC, THORChain marks its first move into supporting permissionless cross-chain swaps for privacy-focused assets.
What Is Zcash?Zcash launched on October 28, 2016, as a privacy-focused cryptocurrency built from Bitcoin’s codebase. Like Bitcoin, it uses a UTXO-based architecture and has a maximum supply of 21 million coins. The key difference is that Zcash gives users the choice between transparent and shielded transactions.
Transparent transactions work much like Bitcoin transactions. Addresses, amounts, and transaction history can all be viewed publicly onchain.
Shielded transactions use zero-knowledge proofs to verify that a transaction is valid without publicly revealing the underlying transaction information.
Getting to this level of sophistication wasn’t a one-time achievement. Zcash’s privacy technology has gone through several generations as the protocol has continued to improve its approach to privacy, security, and verifiability. Its shielded technology has evolved from Sapling to Orchard, with each generation refining how private transactions are created and verified.
In July 2026, Zcash activated its NU6.3 network upgrade, which introduced Ironwood. The upgrade added a new shielded pool designed to strengthen the integrity and verifiability of Zcash’s shielded supply. That continuous development has helped Zcash remain relevant almost a decade after its launch.
ZEC has seen several days with more than $1 billion in daily trading volume, and at times volumes have climbed above $2 billion. However most of that activity has taken place on centralized exchanges and before THORChain’s integration, Maya Protocol was one of the only venues where users could access ZEC in a full permissionless way.
How the Zcash Integration WorksZcash is built around a Bitcoin-style UTXO architecture, which allowed THORChain to build on much of the infrastructure it already uses for chains such as Bitcoin, Litecoin, and Dogecoin. However, Zcash still has its own transaction rules, fee model, RPC behavior, and network upgrades that require dedicated support.
The integration includes:
Zcash-specific UTXO support: THORChain recognizes ZEC as its own UTXO-based blockchain and includes the extra transaction handling Zcash requires.Dedicated ZEC RPC handling: Zcash behaves differently from other Bitcoin-style chains at the RPC level, so THORChain includes ZEC-specific logic for observing the network and managing transactions.UTXO transaction safety: THORChain includes safeguards to prevent ZEC transaction inputs from being reused while an outbound transaction is still being processed.Zcash fee handling: The integration supports Zcash’s ZIP-317 fee model instead of treating ZEC fees the same way as Bitcoin fees.ZEC oracle support: ZEC is included in THORChain’s enshrined oracle infrastructure, allowing the protocol to track its market price.Network upgrade support: THORChain’s Zcash client has been updated to support the NU6.3 Ironwood upgrade, including its new consensus branch.Together, these components allow THORChain nodes to observe the Zcash network, track vault funds, construct and sign outbound transactions, and coordinate native ZEC swaps through THORChain's decentralized vault infrastructure.
What About Zcash Privacy?Zcash supports both transparent and shielded transactions, but THORChain’s ZEC integration currently uses Zcash’s transparent UTXO infrastructure.
That means swapping ZEC through THORChain doesn’t provide the same privacy as sending funds between shielded Zcash addresses. The transactions remain publicly traceable, and THORChain activity such as swaps, fees, and vault movements can still be viewed through explorers and other onchain analytics tools.
In other words, THORChain gives ZEC native cross-chain interoperability without making the underlying swap activity private or inaccessible. Zcash’s shielded transactions remain a separate feature of the Zcash network.
Another Major Native Asset Comes to THORChainZcash has survived multiple crypto cycles while continuing to push forward one of the ideas that originally made cryptocurrency interesting: users should have more control over how their money moves.
THORChain extends that idea in a different direction. Instead of requiring ZEC holders to hand custody of their assets to a centralized exchange just to move between blockchains, THORChain gives them a native route into assets like BTC and ETH while keeping the swap decentralized and non-custodial.
No wrapped ZEC. No bridge. No centralized exchange account. Just native ZEC moving between blockchains through THORChain.
Chad Barraford said on Unchained he will raise with THORChain’s Treasury the idea of sending some of THORChain’s developer fund income from the Bitget hack back to the exchange.
THORChain co-founder to ask treasury about refunding fees on stolen crypto
Posted October 6, 2026 at 5:25 pm ET.
THORChain co-founder Chad Barraford said he will ask the protocol’s Treasury about sending part of what its developer fund earned from the Bitget hack back to the exchange. “I’ll take that up with the Treasury and have a conversation about that idea,” Barraford said on Unchained on Monday, in a debate with security expert Taylor Monahan, who also co-hosts Unchained’s Uneasy Money podcast.
The Treasury could take “some percentage of the income” that the developer fund “actually has control over” and send it to Bitget, he said on the show. He said he hadn’t looked at what the fund receives in a while.
Attackers took $387.5 million from Bitget on Sept. 24 and routed stolen funds through THORChain into bitcoin. The protocol rejected Bitget’s request to block the attacker’s wallets, saying it “doesn’t censor by design.” Bitget has said it is using its Protection Fund to cover the losses.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What the Swaps Earned The laundering swaps paid $573,226 in THORChain liquidity fees through Oct. 2, according to an analysis by researcher Andrey Sergeenkov. That was 75.3% of the $761,725 in protocol and service fees he tracked, a total that does not include affiliate fees.
Monahan said on the show that the accusation is that THORChain “profits directly and very heavily” from stolen funds, which makes people there less likely to act. Barraford said on the show that the developer fund’s share is about 5%. “It’s a very small sliver,” he said. Over the protocol’s full history, he said, illicit income is “barely a blip.” Monahan said that over a short enough period, those flows are “literally the majority of the fees and the majority of the volume.”
Monahan argued that even a six-figure return would matter, because it would show the protocol does not want to profit from thefts. “To be fair, I don’t profit at all from this activity,” Barraford said on the podcast, later narrowing that to directly, “or maybe not even indirectly.”
Up to Each Node Node operators who object can send their own rewards back to Bitget, Barraford said. Asked whether he would recommend it, he said on the show, “I think it’s up to the individual to make their own choices. It’s not up to me.”
He maintained that THORChain cannot block individual swaps fast enough, because its validators take days to reach the two-thirds majority needed to act. Monahan said THORChain has acted quickly before when it chose to, pointing to its decisions on its ThorFi lending feature and on its own hack. Barraford replied on the show, “With consensus, you could change anything you want,” adding that this holds for any protocol and that Bitcoin and Ethereum also choose not to act.
Talks With U.S. Agencies Asked about THORChain’s legal exposure, Barraford said U.S. government agencies, which he declined to name, reached out to him in 2022 or 2023 to understand how THORChain works. “They weren’t really interested back then either,” he said on the podcast, adding that the conversations were “not adversarial.”
Related Listen: How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack
AI-assisted content: This article was produced with the assistance of AI tools and was reviewed, edited, and fact-checked by a member of the Unchained editorial team before publication.
THORChain could have taken steps to disrupt funds linked to the Bitget hack, according to co-founder Chad Barraford. However, he said implementing an effective response would have been difficult, as coordinating validators can take days while attackers can quickly move funds to new addresses.
Barraford discussed the issue during an Unchained interview hosted by Laura Shin alongside onchain analyst and investigator Taylor Monahan. The debate centered on whether THORChain could have done more after Bitget asked the protocol to stop serving addresses linked to wallets that drained $387.5 million from the exchange.
Barraford said THORChain does not currently have a mechanism that allows the protocol to immediately censor individual transactions or wallets. He said creating one would still leave validators with the problem of coordinating quickly enough to act before stolen funds move elsewhere.
Reaching the two thirds validator consensus needed for certain actions takes about three days on average and can sometimes take as long as two weeks, Barraford said. A faster response, he argued, would require redesigning THORChain to give a smaller group more control.
The problem becomes more complicated once transactions are already underway.
Barraford said halting trading with swaps in progress would require reallocating those funds through a vault migration, which itself needs two thirds consensus and could take one to two weeks.
Validators could theoretically block a known Ethereum address before its funds entered the protocol, he added, but the attacker could simply switch to another address and continue trading.
“You can’t have the fast enough response because the protocol is decentralized,” Barraford said.
The discussion nevertheless showed that THORChain was not entirely without options.
Shin pointed to existing functions capable of halting Ethereum or Bitcoin trading. She argued that the Ethereum halt function could have sent certain swaps associated with stolen funds back to their sender rather than allowing them to continue through the protocol.
She also highlighted THORChain’s MakePause function, which she said allows a single node to temporarily halt chains for 720 blocks, or roughly an hour, potentially giving validators time to discuss a response.
Barraford’s argument was not that THORChain can never stop trading. Instead, he argued that using those mechanisms against an active hacker creates practical problems because a broad halt affects legitimate users while validators coordinate a more permanent response.
That coordination is easier when THORChain itself is under threat.
Barraford said validators tend to quickly reach consensus when an exploit threatens the protocol because protecting THORChain is part of their responsibility.
“When there’s a bug or an exploit on ThorChain, there is a wide consensus immediately amongst all validators that we need to pause trading,” he said.
Monahan challenged that distinction by pointing to previous instances in which THORChain had been willing to interrupt its own operations.
She cited the ThorFi incident, when an admin key was used as an interim measure to pause lending before validators approved further action through consensus. Barraford stressed that the key itself could only change configuration and could not directly reallocate user funds.
Shin also compared the situation with the response to the DAO hacker years earlier.
She said ShapeShift repeatedly reacted as the hacker attempted to convert stolen funds into Bitcoin. Although the attacker could continue switching addresses, Shin argued that responding still made moving the funds harder and appeared to cause the hacker to give up at certain points.
Barraford responded that ShapeShift was centralized at the time, allowing it to react far more quickly than a validator driven protocol such as THORChain.
Taylor Monahan pushed the broader argument that THORChain’s inability to perfectly stop stolen funds should not prevent validators from trying to make laundering more difficult.
She argued that the protocol had mechanisms available to intervene and questioned the use of decentralization as a justification for taking no action when a large share of activity on a route consisted of stolen funds.
The same disagreement had already surfaced following the Bybit hack.
Barraford said some THORChain validators attempted to pause Ethereum trading when stolen Bybit funds moved through the protocol, but the effort failed because most validators opposed the action.
“A few did it, but the vast majority didn’t want to do that,” Barraford said.
He later said roughly 20 validators may have left around the disagreement, although he stressed that he did not remember the exact number and said the network has since added more operators.
The previous vote illustrates the distinction at the center of the Bitget debate. THORChain validators can attempt to interrupt trading, but doing so does not guarantee that enough operators will agree or that they can coordinate before an attacker moves the funds.
Later in the interview, Barraford acknowledged more directly that validator consensus could ultimately be used to block laundering.
Asked by Shin what would happen if enough node operators joined THORChain and supported censoring illicit transactions, Barraford replied, “Then laundering would be blocked.”
“If you get a two third majority agreeing that we should censor transactions, then sure, that would be the way of the community,” he said.
Shin also raised NEAR Intents as an example of a protocol taking a more active approach.
She said the project’s Shield risk layer can refuse quotes or halt swaps during execution and had blocked an attempted $50 million in laundering. According to Shin, the system also froze roughly $500,000 during a swap and planned to return $340,000.
Asked whether THORChain could introduce something similar, Barraford said it was technically possible if validators supported it.
“Maybe. If the nodes want to deploy something like that, it’s up for validators to determine,” Barraford said.
“If the nodes wanted to do that, they could. My guess is they wouldn’t, but I don’t speak for them.”
The exchange ultimately narrowed the dispute from whether THORChain can intervene at all to how quickly and effectively it could do so.
The protocol has mechanisms capable of interrupting trading, and validators could adopt stronger controls through consensus. Barraford’s position, however, is that coordinating those measures quickly enough to stop an active hacker is difficult under THORChain’s current design.
He summarized that governance limitation later in the interview by acknowledging that validator consensus can ultimately change the protocol.
“Yes, if you get consensus behind any change, you could change anything,” Barraford said.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
ZachXBT posed as a client to a Chinese crew laundering Bybit funds for Lazarus.The launderer called his client Kim Jong-un and gave daily updates on his mood.Between orders came rabbit stew photos, a mahjong invite, and a Disney trip.ZachXBT posed as a scammer to infiltrate a Chinese crew accused of laundering most of Bybit’s $1.5 billion for North Korea. His launderer repaid him with Kim Jong-un updates, dinner photos, and a mahjong invitation.
The investigator says the intel helped freeze funds and attribute Bybit flows. He fronted $349,700 of his own money and took a 5% cut on every order, paid to the people he was investigating.
Where Do You Find North Korea’s Launderer? In THORChain’s Help ChatZachXBT gets a lead in February 2025, days after the Bybit hack. He spotted 15 or more accounts in public Telegram and Discord groups seeking help with orders tied to stolen funds.
One of them, using the alias Jimmy Green, had posted a stuck transaction in THORChain’s 10,845-member community chat. A THORSwap team member replied asking where he was swapping. The funds, ZachXBT says, were Bybit money that had moved through THORChain.
Jimmy’s Telegram bio was a job ad. Written in Chinese, it offered to process flagged BTC, ETH, SOL, and TRX through a mixing service. Nothing, it promised, would flow back. The account used a US phone number with a Virginia area code.
Jimmy Green’s User Info. Source: ZachXBTZachXBT’s cover story was marked ETH from the privacy tool Railgun that needed to become clean USDT on Tron. Jimmy quoted 5%. One early order came back as exactly 23,750 USDT, a 5% haircut on $25,000.
How Many Times Can Kim Jong-un Come Up in One Chat?Jimmy did not say “the client.” He said Kim Jong-un, by name, and treated him like a moody supplier.
Jimmy Talks About Kim Jong-un to ZachXBT (kj). Source: ZachXBT Later updates read like a weather report. Kim had called a halt because the coins sent back were too dirty and under investigation. Kim was testing Bitcoin because he feared USDT freezes. Of 50 BTC released, Jimmy’s team got 30.
At one point “the foreigners” ordered a ten-day break. Jimmy grumbled that the North Korean supply was suspended and his team needed more work.
ZachXBT, in character, asked whether Kim Jong-un had kept him busy that day. Jimmy replied that he was busy every day now.
He pitched his firm as professional coin laundering, isolation, and freezing prevention, and called it China’s largest. Then he told ZachXBT his team had laundered almost all of Bybit’s $1.5 billion in ETH.
ZachXBT says the boast matched laundering patterns he had already traced. It remains Jimmy’s claim, not a verified figure. The investigator has previously named a Chinese OTC trader for moving Lazarus funds.
Jimmy Green Boasting About $1.5 Billion ETH Laundering. Source: ZachXBTDid the Launderer Really Call the Money’s Next Move?The most useful thing Jimmy did was talk before acting. One morning, he announced that North Korea’s work would start tomorrow and Bitcoin would return to Solana. The next day, ZachXBT says, the funds moved to Solana.
On March 12, 2025, Jimmy sent a screenshot of himself bridging 1.192 BTC into ETH. ZachXBT matched the amount and timing to a THORChain order created minutes after the message.
Jimmy Bridges 1.192 BTC Into ETH. Source: ZachXBTJimmy also handed over three Solana addresses. They exposed a cluster of $12 million or more in Bybit funds cycling through BTC, ETH, SOL, and Tron. Tether later froze 442,000 USDT linked to it.
He solved an older case by accident. Jimmy mentioned a team he knew had around $300,000 frozen in 2024. ZachXBT found it onchain, as 332,000 USDC from the Poloniex exploit.
A separate brag about washing $3 million in fraud proceeds led to a hot wallet at Huione Guarantee. ZachXBT notes the Cambodian marketplace has since been sanctioned and its former chairman arrested.
Who Was Chasing Whom?Between orders, Jimmy sent photos of two steaming pots of stew. The meat was wild rabbit and wild bird, shot with a gun. He asked whether ZachXBT could play Chinese mahjong.
Other days brought his fat-reducing meal, a cup of American coffee, and complaints about the cold. ZachXBT says the small talk also covered family life and vacations at Disney.
One photo showed Jimmy’s phone displaying a wallet holding about 1.2 million USDT. The laptop behind it had Google Translate open, which explains the grammar.
Jimmy was clear about where his team stood. “We are honest businessmen,” he said, moments after sending through another batch of USDT.
The pause before it, he explained, was because his team had suspected ZachXBT of fooling them. Integrity, he said, came first.
Meanwhile, the detective played hard to get. Jimmy messaged good morning past midnight, hello an hour later, and a lone question mark before dawn. ZachXBT scolded him.
ZachXBT Scolded Jimmy. Source: X PostJimmy apologized and said his team had $1 million ready to start at any time.
ZachXBT says he handed everything to private investigators and law enforcement, which is why the thread arrived 19 months late. He puts his DPRK-related freezes since 2022 at $75 million or more, against billions stolen.
The same support-ticket pattern resurfaced last month. Launderers moving funds from the $387 million Bitget hack openly asked for help in public groups. North Korea’s contractors, it turns out, still need customer service.
Disclaimer
BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.
THORChain will hold an Ecosystem Spotlight live stream on Riverside on October 10th at 14:00 UTC. Quinten from Zano will discuss the privacy-focused layer-one network, its private proof-of-stake design and tools for private tokens and applications.
Refer to the official tweet by RUNE:
âš¡ Saturday October 10 on the THORChain Podcast | Ecosystem Spotlight at 10AM EDT / 2PM UTC.@KentonC137 and @patriotsounds are sitting down with @Mr_Kwibs from @zano_project.
Zano is a privacy-by-default L1 running private Proof-of-Stake with hidden amounts, where builders… pic.twitter.com/Ua7B6DRR8A
THORChain
RUNE Info THORChain is a decentralized liquidity protocol that enables users to easily exchange cryptocurrency tokens over the network without the need for intermediaries. This is achieved by creating a liquidity pool that automatically establishes prices and provides liquidity for trading.
The key feature of THORChain is its ability to facilitate secure, fast, and reliable cross-chain asset operations. This means that users can directly exchange one cryptocurrency for another, even if they exist on different blockchains.
The RUNE token in THORChain is used as collateral for validators in the network and to ensure liquidity in the liquidity pools.
Protocols and services used to move funds stolen from Bitget have collected $761,725 in fees during the laundering process, while an independent researcher has traced $259,718 in THORChain affiliate fees to recipients with additional financial links to wallets involved in the swaps.
Summary
Protocols and services collected $761,725 in fees from transactions used to move funds stolen in the $387.5 million Bitget hack, according to independent researcher Andrey Sergeenkov. THORChain liquidity providers received $573,226, while MetaMask collected $149,417, Chainflip received $26,751 and CoW EthFlow received $12,332. Sergeenkov traced $259,718 in THORChain affiliate fees to seven addresses with additional financial links to wallets involved in moving the stolen funds. The largest linked affiliate address received $177,499, with part of its fee income later converted to USDT and eventually transferred to an address labeled as an OKX hot wallet. Another $206,196 in affiliate fees went to recipients for which Sergeenkov did not establish additional financial links to the wallets involved in the stolen fund movements. According to research shared with crypto.news by independent researcher Andrey Sergeenkov, the analysis covered transactions through Oct. 2 at 10:22 UTC and examined both the services used to exchange the stolen assets and the addresses named as fee recipients in THORChain swap instructions. The findings follow the Sept. 24 theft from Bitget’s hot and warm wallets, which the exchange later valued at approximately $387.5 million.
Sergeenkov calculated that THORChain liquidity providers received $573,226 from swaps involving the stolen funds. MetaMask collected another $149,417, while Chainflip received $26,751 and CoW EthFlow received $12,332, according to the transaction data presented in his research.
The analysis goes beyond identifying protocols that processed the assets. Sergeenkov examined THORChain affiliate fees separately and traced how some of the recipient addresses interacted with wallets involved in moving the stolen funds.
THORChain affiliate fees reached $259,718 THORChain swaps can contain an affiliate fee that is routed to a separate recipient specified in the swap instruction. Sergeenkov found $259,718 in affiliate fees went to seven addresses where subsequent transaction activity provided what he described as additional financial links to wallets involved in the stolen fund swaps.
His analysis does not claim that being named as an affiliate recipient proves an address belongs to the attacker. An interface or script can insert a recipient address before the sender signs a transaction, including when a service collects a referral fee. Sergeenkov said the recipient field alone therefore cannot establish who controls an address.
Instead, he separated recipients where transaction history provided another connection.
The largest address in this category, thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4, received $177,499 in fees. Sergeenkov linked it to the laundering activity through shared recipients of the main funds.
Another address received $56,514 and had the same type of connection. A third collected $18,080, with Sergeenkov finding that some fee proceeds were returned to a wallet that had submitted one of the swaps.
Other linked recipients collected $4,544, $2,885 and $196. One address received less than $1 before transferring funds to another fee recipient examined in the analysis.
In some cases, different swaps that named different affiliate recipients sent the principal stolen funds to the same Bitcoin destination wallets. Other transactions showed fee proceeds moving back to a swap sender or between reviewed fee recipients, according to Sergeenkov.
Some fee proceeds eventually reached an OKX labeled wallet Sergeenkov traced part of the $177,499 received by the largest linked affiliate address beyond THORChain.
Part of its RUNE fee income was exchanged for USDT and then passed through two Ethereum wallets. The funds eventually reached an address labeled “OKX Hot Wallet 5” by Etherscan, according to the research.
Sergeenkov said OKX could use its internal deposit records to determine whether the transfers corresponded to a customer account and identify its holder. His analysis does not establish who owns the account or whether the exchange customer was involved in the Bitget theft.
The fee trail adds another layer to the movement of assets following the Bitget breach. As crypto.news previously reported, roughly $269 million passed through THORChain across 7,804 transactions by BlockSec’s Sept. 29 snapshot, although the figure represented pass through value and could include the same funds moving through the protocol more than once.
A Bitget linked wallet later completed 27 THORChain swaps, converting roughly 2,390 ETH into 75.2 BTC worth approximately $6.3 million at the time.
Another $206,196 went to recipients without established links Sergeenkov identified a separate group of THORChain affiliate recipients that collected $206,196 from swaps involving the stolen funds but for which he had not established additional financial links to the hackers’ wallets through the transaction history reviewed.
The distinction is central to his analysis. Addresses in this second group appeared in signed swap instructions as fee recipients, but Sergeenkov did not find the extra fund movements used to place the first group in the linked category.
The largest recipient in the unlinked group was associated with the registered THORChain name naswap and received $102,344. A THORChain holding account credited with fees under several names, including w1, t, vi, ss, dx, ej and symbiosis, accounted for $92,438.
Another address associated with the name tch received $7,245, while an address using ns collected $2,994. A further recipient received $1,176. Sergeenkov said final payouts from the holding account had not been traced in his analysis.
His findings arrived after Bitget and THORChain publicly disagreed over whether the protocol should intervene in transactions involving identified attacker addresses. Bitget had asked THORChain to refuse service to addresses linked to the breach, while THORChain said its emergency halt mechanisms were designed to protect network operations and did not provide a selective freeze for individual transactions.
Other services took a different approach. NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers linked to the Bitget wallets and froze approximately $503,000 during execution. Roughly $166,000 passed through before the suspected flows were stopped, according to NEAR Intents general manager Alex Shevchenko.
Sergeenkov’s research concerns fees generated while the stolen assets were moved and exchanged, not the amount recovered or frozen. His $761,725 total consists of fees earned by protocols and services from the reviewed swaps, while the $259,718 and $206,196 figures identify two groups of THORChain affiliate recipients based on whether his transaction review found additional financial links to wallets involved in moving the stolen funds.
THORChain’s co-founder wants you to rethink what decentralization actually means. His case: a handful of operators could halt THORChain, but even fewer parties could stop Bitcoin or Ethereum.
Chad Barraford, THORChain’s co-founder and lead developer, made that argument in October 2026. It’s a bold claim to make about the two largest blockchains, especially while your own protocol is taking heat over a hack.
The fight over who gets to say no The debate flared back up after Bitget suffered a hack in September 2026. The estimated loss sits at $387.5 million.
THORChain then declined to intervene on funds linked to the hackers. That refusal is the source of most of the criticism.
Barraford’s defense rests on neutrality. In his view, THORChain cannot pick and choose which transactions to block, any more than Bitcoin or Ethereum can.
So who actually makes decisions on THORChain? According to Barraford, governance is collective. Validators vote, and most changes require approval from two-thirds of nodes.
Why critics aren’t convinced The pushback centers on how THORChain is built. The protocol uses a threshold signature scheme, or TSS, to control funds.
Advertisement
Critics argue that collective custody creates vulnerabilities Bitcoin and Ethereum simply don’t have. Those networks don’t hold pooled user funds under a shared signing arrangement in the same way.
Emergency procedures can pause the network for multiples of 720 blocks. Each 720-block window works out to approximately 1 hour.
More pointedly, governance votes under THORChain’s Mimir system may need as few as three or four validators for certain actions. That’s where the line about four operators halting the chain comes from.
Critics frame this as a contradiction. If a few validators can pause the whole network, why can’t they freeze funds tied to a hack?
The blacklist that isn’t there anymore THORChain’s answer partly traces back to February 2025. That’s when the protocol retired address blacklisting.
The stated reason was neutrality. THORChain said it can no longer selectively block any addresses, which removes the tool critics might want it to use now.
This distinction matters to Barraford’s argument. Pausing a network affects everyone equally. Blocking a specific address singles someone out, and that’s the move THORChain says it gave up.
A familiar crypto dilemma, with a sharper edge Bitcoin and Ethereum have largely answered by making governance slow and hard to change. That rigidity frustrates developers but makes the networks resistant to pressure from any single group.
THORChain took a different path. It chose flexibility, with emergency levers and validator votes that can move fast when something goes wrong.
Barraford is effectively arguing that the outcome is the same. If neither Bitcoin nor Ethereum nor THORChain will censor specific transactions, then all three share the same core neutrality, regardless of how many hands sit on the pause button.
Critics counter that the number of hands is exactly the point. A network that a small group can halt has a different risk profile than one that requires broad coordination to stop.
What this means for THORChain and DeFi For DeFi more broadly, investors evaluating protocols may need to look beyond marketing claims of decentralization and examine how governance actually works.
Key questions include how many validators are required for emergency actions, who holds signing authority over pooled funds, and what tools the protocol has deliberately removed.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
Users can now access the Monero network through the THORWallet app, with support for core functionality including sending and receiving XMR.
The integration goes beyond basic wallet functionality. Users can create and manage multiple Monero accounts derived from the same wallet seed, providing greater flexibility when managing their activity across the network.
THORWallet also gives users the ability to configure their own Monero node. Users who prefer to interact with a specific node can configure it directly within the wallet, ensuring their Monero activity is routed through that node. For everyone else, THORWallet provides a default node for communicating with the Monero blockchain. THORWallet runs a light weight implementation: your keys, balances and transaction history are computed and stored on your device and never leave it.
Cross-Chain Monero Swaps Are ComingThe next major step for the integration is native cross-chain swapping.
Monero support on THORChain is currently being tested and audited. Once it goes live, THORWallet’s Monero integration will be production ready for native XMR cross-chain swaps directly within the app.
This will allow users to swap between Monero and assets such as Bitcoin, Ethereum and others without relying on centralized exchanges or custodial intermediaries.
For example, a user will be able to swap XMR directly to BTC, or BTC to XMR, stablecoins, SOL, ZEC and more through decentralized cross-chain infrastructure while remaining in control of their assets throughout the process.
With the Monero integration now underway and cross-chain swaps approaching production, THORWallet moves another step closer to its goal of becoming a one-stop shop for DeFi.
THORChain has a large amount of data available onchain, but understanding what that data means is not always easy.
boone.tools was created to solve that problem. The site brings together a growing collection of dashboards covering THORChain’s pools, Protocol-Owned Liquidity, node votes, the App Layer, network economics, and several other parts of the protocol.
The goal of this is to make the state of THORChain easier to understand so that the people participating in the network can make better-informed decisions.
Why Boone Built boone.toolsBoone is a long-time THORChain community member and contributor who has become increasingly involved in the protocol's development. He has contributed to discussions about THORChain's economic model, including advocating for Protocol-Owned Liquidity and the removal of block rewards. More recently, he has been working on THORChain's Monero integration, developing the core proof of concept for connecting Monero to the network.
His motivation for creating boone.tools came from a simple problem. Whenever he wanted to investigate something about THORChain or verify a particular claim, he often struggled to find the necessary information in one place. Instead of repeatedly collecting the same data, he started building tools that could track it automatically.
As Boone explained during our interview, "I either want to know something or I want to show someone else something." This curiosity has been the driving force behind boone.tools, with each dashboard addressing a specific question about the protocol.
Interestingly, Boone never intended to build an entire analytics platform. It started when he experimented with building a dashboard to track THORChain's newly introduced Rapid Swaps feature. After sharing it with the community, people began requesting additional tools, and the project gradually developed into a much larger collection of dashboards.
Even the name came about organically. Boone drew inspiration from the existing community analytics platform rune.tools, which had made its source code publicly available. He used that project as inspiration for his own dashboards and named his platform boone.tools as a playful reference to rune.tools.
Today, boone.tools helps community members better understand THORChain by providing direct access to information about the network's activity and economics. This is especially valuable for a decentralised protocol where Nodes are responsible for making important decisions about how the network operates.
By making this information more accessible, Boone hopes to give community members a shared factual basis for discussions about THORChain's future. While participants may disagree about which direction the protocol should take, they can use the underlying blockchain data to better understand its current state and make more informed decisions.
Explore THORChain Through boone.toolsboone.tools has gradually developed into a collection of 16 specialised dashboards, each designed to help users understand a different part of THORChain.
The dashboards range from Status, Rapid Swaps, Pool Analysis and Financials to tools tracking Protocol-Owned Liquidity, RUNE burns, Node bonds, vaults, the Treasury, dynamic fees, governance and App Layer activity. Other dashboards include TC Fee Dash, Pool Dislocation, POL TVL, POL Tracker, Burn Tracker, Bond Tracker, Vault Explorer, ADR26 Dynamic Fees, Vote Tracker, App Layer / Base Layer, and Briefings.
Together, they provide a much more detailed view of what is happening across THORChain, from network health and swap activity to liquidity, protocol finances and governance.
Covering all 16 tools in detail would quickly become overwhelming, so we asked Boone which metrics he considers most useful when analysing THORChain. He highlighted the following five metrics that he considers to be the most important.
1. Pool AnalysisThe Pool Analysis dashboard gives users a detailed look at how THORChain's individual liquidity pools are performing. Boone originally built it because he wanted to understand which assets were responsible for generating the protocol's trading volume and revenue. Although this information was available through different sources, there was no single place where he could easily compare the performance of individual pools.
For each pool, users can compare its internal price with an external oracle price, see its liquidity depth, and examine the underlying asset and RUNE balances. The dashboard also tracks trading volume and liquidity fees across different periods. Users can sort pools by these metrics to identify which assets are generating the most activity and revenue.
One of the most useful metrics is fees relative to pool depth, which Boone considers an important indicator of capital efficiency. It shows how much fee activity each pool generates relative to the liquidity available. This information has become particularly relevant with the introduction of Protocol-Owned Liquidity (POL), as the protocol uses fee generation relative to liquidity depth as part of its process for determining where additional liquidity should be allocated.
Users can also select individual pools to examine their historical performance. The dashboard provides charts showing daily trading volume, daily fees, cumulative fees, and changes in pool depth over time.
Bitcoin PoolThese historical comparisons make it possible to identify how liquidity and trading activity develop within individual pools. For example, users can examine whether a pool has attracted additional liquidity or whether its capital efficiency has improved over time.
As Boone explained during our interview, Pool Analysis is one of the dashboards he checks most frequently himself. It gives him a straightforward way to understand which assets are generating revenue and how efficiently THORChain's liquidity is being used.
2. POL TrackerThe POL Tracker focuses on THORChain's Protocol-Owned Liquidity and how the protocol builds and manages its own positions in liquidity pools.
Boone has been one of the strongest advocates for POL within the THORChain community. He believes that allowing the protocol to build its own liquidity addresses several important problems, including its historical dependence on the independently managed Treasury to provide liquidity for new and existing pools.
As Boone explained during our interview, POL allows THORChain to build a liquidity base that it controls itself. This reduces its reliance on external liquidity providers and gives the protocol a mechanism for directing additional capital toward pools that need it.
The POL Tracker provides the data needed to follow this development. Boone considers the current value locked in POL its most important metric. Alongside this figure, the dashboard displays how much RUNE has been deposited through the mechanism and how that capital has been allocated across individual pools.
Users can examine POL's positions, its ownership share within individual pools, and how deposits have developed over time. Another important metric estimates POL's share of the liquidity fees generated by the pools in which it participates. However, Boone emphasised that this figure requires some interpretation.
Simply attributing fees according to POL's ownership share does not necessarily mean that POL was responsible for generating those fees. Some swaps would have taken place regardless of whether the protocol had provided additional liquidity.
The purpose of this calculation is therefore to illustrate POL's potential contribution to THORChain's economics. By providing deeper liquidity, POL can improve swap execution and potentially attract additional trading activity. This creates the possibility of generating more revenue that can subsequently be reinvested into liquidity.
The dashboard also includes a metric that treats RUNE deployed through POL as effectively removed from circulation. Boone emphasised that this is not a conventional token burn. The RUNE remains within liquidity pools, and its balance can change as market prices fluctuate.
Together, these metrics allow users to follow how POL develops and evaluate its potential contribution to THORChain's liquidity and long-term economic sustainability.
3. Cross-Chain CompetitorsThe Cross-Chain Competitors dashboard compares THORChain's economics with competing cross-chain trading systems, including Chainflip and NEAR Intents. Boone developed this comparison because he believes that trading volume alone provides an incomplete picture of how successfully a protocol is performing.
A protocol can generate significant trading activity while spending substantial amounts on token incentives to attract users and liquidity. Consequently, higher trading volume does not necessarily translate into a stronger economic model. To account for this, Boone's dashboard compares the protocols using a straightforward calculation: profitability = fees − token emissions.
This distinction is especially important when comparing THORChain with NEAR Intents. Although NEAR Intents has periodically generated substantially more trading volume, Boone argues that its economic performance looks very different once token emissions are taken into account. THORChain, meanwhile, operates with virtually no ongoing token emissions, allowing it to retain considerably more of its income under this methodology.
During our interview, Boone explained that his dashboard has generally shown THORChain generating substantially more net income than its competitors. The comparison helps illustrate why trading volume alone is insufficient to evaluate the economic sustainability of different cross-chain protocols.
It is important to recognise that this calculation does not represent each protocol's complete operating profit. Instead, it provides a consistent framework for comparing swap-related income against token subsidies, helping users understand which protocols generate revenue without relying heavily on continued token issuance.
4. Vote TrackerThe Vote Tracker makes THORChain's onchain governance activity more accessible by providing a detailed overview of Node voting.
THORChain Nodes use Mimir votes to change many of the parameters that determine how the network operates. These include economic settings, transaction fees, chain configurations, and operational parameters.
Before developing the dashboard, Boone found that understanding ongoing votes and their current status could be unnecessarily difficult. Although some information was available through Discord and existing tools like rune.tools he wanted to provide a more detailed overview that allowed users to examine voting activity directly.
The Vote Tracker provides three main views. The first organises voting activity by parameter, showing which Nodes have voted, their proposed values, and how many additional votes are needed for a change to take effect. Users can also examine historical votes and see when parameters were actually updated, such as when Nodes voted to enable or disable Bitcoin trading.
The second view focuses on individual Nodes, allowing users to examine their voting history and average response times. This is particularly useful for bond providers who want to understand how actively Nodes participate in governance and whether their decisions align with their own preferences.
Finally, the dashboard provides a searchable overview of THORChain's current Mimir values and network constants, giving users easy access to the network's operating parameters.
5. App Layer / Base LayerThe App Layer / Base Layer dashboard tracks how economic activity generated by the Rujira App Layer contributes to THORChain's underlying network. It provides an overview of how funds move between the two layers and displays the cumulative value transferred to the Base Layer.
The dashboard distinguishes between two sources of revenue. The first consists of fees generated when App Layer transactions use THORChain's Base Layer infrastructure, which contribute to System Income. The second consists of revenue generated directly by App Layer applications and subsequently shared with THORChain's Protocol Reserve.
As Boone explained during our interview, these revenue streams are distributed differently, making it important to track them separately. The dashboard also distinguishes between revenue generated and funds actually transferred to the Base Layer, as some revenue accumulates in a contract before being distributed gradually over time.
Finally, the dashboard tracks funds allocated to App Layer POL, which operates separately from THORChain's Base Layer POL mechanism. Together, these metrics give users a clearer understanding of how App Layer activity generates revenue, how that revenue is distributed, and how much economic value ultimately reaches different parts of THORChain.
A Better Way to Understand THORChainboone.tools makes it easier to understand what is happening across THORChain without having to piece together information from different sources.
The dashboards give users a clearer view of how the network is performing and how different parts of the protocol are developing over time. This is especially useful for a decentralised network like THORChain, where many important decisions are made by Node Operators.
Better access to this information will not mean everyone agrees on what THORChain should do next. It does, however, give the community a stronger basis for those discussions and makes it easier to make decisions based on what is actually happening onchain.
THORChain x Houdini Swap Podcast #240 ft. Aaron from Houdini Swap, KentonC137 & patriotsounds | October 3, 2026 | Watch the full episode on YouTube
By Raynalytics
TL;DRHoudini Swap is now an optional private swap and private-send route on THORChain Swap. Aaron described it as a two-exchange route that breaks the visible on-chain link between sender and recipient, while retaining transaction screening and support.The integration reignited a community debate over user clarity, compliance, and whether a partner service could pull volume from native swaps. Kenton argued that the option should remain explicit and voluntary.Kenton’s Treasury case is that private-route revenue could help cover frontend costs and wallet integrations without adding a new fee to ordinary THORChain Swap trades.$XMR was still in stagenet testing. The hosts discussed a quiet, liquidity-first launch rather than promoting a pool before it can handle meaningful swaps.The marketing update focused on search and answer-engine optimisation, more API discovery, standardised protocol data, and reaching Bitcoin-native audiences.For a protocol built around public, native-asset swaps, adding a privacy-focused partner route was always going to invite scrutiny. Aaron joined the show to explain how Houdini Swap works, while Kenton and Denny used the second half to address the harder question: whether an optional service can help fund distribution without confusing users about THORChain’s own guarantees.
The answer on the show was not a demand that every user choose privacy. It was a case for clear choice, honest boundaries, and measuring the Treasury thesis against real outcomes rather than projections.
1. Houdini Swap Is an Optional Private RouteThe episode returned to the topic covered in the earlier Houdini Swap debate. Aaron joined to explain what the current THORChain Swap integration is intended to do: give a user an optional private route for a swap or a send, rather than change THORChain’s native swap engine.
Aaron said a private route sends the deposit to a unique, one-time address from the first liquidity provider, converts through an intermediate asset, then moves to a second unaffiliated exchange partner before the final payout. In the example he gave, the route breaks the visible relationship between the source and destination wallets. He said average end-to-end execution is now roughly four to six minutes.
The distinction matters because the service is not presented as fully permissionless on-chain privacy. Houdini uses screening and geo-blocking, and Aaron said its exchange partners can require more information or hold funds only in high-risk cases. The product’s pitch is privacy optionality with operational support, not an attempt to hide those tradeoffs.
"We're not trying to claim that we are 100% permissionless." (Aaron)Aaron also highlighted private payments and batch transactions as live Houdini features, while describing a possible multi-chain on-chain privacy product as future work rather than a shipped integration.
2. Privacy Has Boundaries, and the Team Put Them on the TableThe longest part of the guest discussion was not a sales pitch. It was a direct examination of what Houdini’s privacy model can and cannot promise. Aaron said the design routes through two non-custodial exchange partners, not a Houdini-controlled deposit account. The user temporarily gives up custody while a route executes, but Houdini itself does not hold the assets or operate a pooled mixer.
That architecture is designed to make ordinary blockchain tracing difficult, not to make the service exempt from law or its providers’ risk controls. Aaron said a transaction associated with a high-risk exploit or illicit activity can be stopped by an exchange partner and may require KYC and source-of-funds information. A lower-risk flag, such as a restricted IP address, can instead be reverted so the user receives funds back without a KYC process.
He cited 40,000 private transactions through Houdini’s Solflare integration, with six flags that he said were restricted-IP cases rather than KYC cases. The figure is Houdini’s own example, not a THORChain-wide measure, but it explained why the team frames the product as a compliance-aware privacy option.
"Houdini is not a site for criminals." (Aaron)For a THORChain audience, the practical takeaway is simple: private routing can reduce the public link between wallets, but it is neither a guarantee against all scrutiny nor a substitute for understanding the route being selected.
3. The Controversy Is About Choice, Fees, and Who BenefitsAfter Aaron left, Kenton addressed the pushback directly. Some community members worried that the Private tab could be unclear, that Houdini might poach volume, or that the integration could blur the line between THORChain’s permissionless protocol and a partner’s screened service. The interface currently identifies the route as powered by Houdini Swap and requires users to accept terms before proceeding.
Kenton’s position was that calling the tab “Private” tells a new user more than “Houdini,” but he was open to an additional acknowledgement that a trade is routed through Houdini. His broader point was that crypto users still need to read what they approve. The feature is intended as an optional service, not the default path every trader must take.
The Treasury argument is economic. Kenton said he does not want new frontend fees added to ordinary THORChain Swap trades, because price is critical when competing with centralised exchanges and aggregators. He sees potential Houdini revenue as a way to help the Treasury fund frontend operations, wallet listings, and marketing while keeping native swap pricing competitive.
"The worst thing we can do is add fees to THORChain Swap." (Kenton)That is still a thesis, not a proven outcome. The episode did not present realised Treasury revenue from Houdini or evidence that the route has increased overall THORChain volume. It made the intended tradeoff explicit: offer a separate service to create optional revenue, while protecting the low-cost native route.
4. $XMR Needs Liquidity Before a Big AnnouncementThe hosts also discussed the next privacy-asset launch. $XMR was described as being tested in stagenet, with a future mainnet release expected to begin as a soft launch. That status is important: the group did not say $XMR was live on THORChain, and they repeatedly warned against treating a technical activation as a ready-for-scale product.
Their concern comes from the recent $ZEC experience. A live but shallow pool can be technically available while still being unsuitable for meaningful swaps. Kenton suggested that a $XMR pool in the region of $50,000 could be sufficient to begin promoting more widely, though he presented that as a rough judgement rather than a formal launch threshold.
"We kind of do only get one shot." (Kenton)The proposed playbook is to let arbitrage and experienced community users expose problems first, build liquidity, then give journalists and the wider market a product that can meet initial demand. The tension is obvious: THORChain’s public development makes a completely secret launch unrealistic, but premature promotion can create the wrong first impression.
Wallet support remains part of that adoption puzzle. Kenton said Rabi and Brave Wallet were among the next THORChain Swap connection priorities, while mobile and desktop $XMR wallet behaviour makes a conventional browser-wallet flow less straightforward.
5. Marketing Is Moving From Search Rankings to AI DiscoveryKenton’s marketing update connected product distribution to how people increasingly find crypto infrastructure. He said THORChain’s answer-engine readiness had risen from roughly 0% to 20% at the starting point to a more consistent 70% to 90% range, while the team works on the harder final improvements.
He also said the API-key flow now receives about one or two requests a day on average, with Google and ChatGPT among the sources people report. The goal is not only to rank when someone searches THORChain by name. It is to appear when a builder searches for a solution to a cross-chain problem.
Kenton is also working with Blockworks and Forge on more standardised protocol reporting, considering paid distribution, and looking for a way into Bitcoin-native media. He named Bitcoin Magazine as a target audience because a small share of that market could matter more than a broad but unfocused campaign.
"The golden ticket [is] that we show up in results when someone's searching for a solution to their problem." (Kenton)One immediate cleanup task is terminology. Kenton asked the community to flag stale descriptions of THORChain as a “liquidity protocol,” because those descriptions feed search and AI systems. The team has begun updating its own documentation to call THORChain what it is: a decentralised exchange.
What to WatchWhether users find the Private route on THORChain Swap sufficiently clear, or whether the interface adds a more explicit Houdini acknowledgement.Whether private-route revenue becomes material enough to support the Treasury case for frontend and wallet-expansion costs.Whether $XMR moves from stagenet testing to a cautious mainnet soft launch, and whether liquidity is deep enough before broad promotion.Whether new wallet connections reduce friction for privacy-asset users without relying on an unreliable WalletConnect flow.Whether THORChain’s search, AI-discovery, data-standardisation, and Bitcoin-media work produces durable builder and user demand.More THORChain data, check out raynalytics.net
Follow Raynalytics for more Weekly Analytics and Podcast recaps.
The firm says the theft pushes North Korea-linked crypto thefts above $1 billion in 2026, while onchain records show stolen XRP being swapped through THORChain.
Free newsletters
Good reporting. Delivered.Choose your coverage: crypto and DeFi, the future of finance, or both.
THORChain has introduced a new Zcash (ZEC) liquidity pool following the completion of a network-wide node churn, moving the privacy-focused cryptocurrency a step closer to full native cross-chain trading on the protocol.
THORChain activates Zcash liquidity poolIn an October 2 X post, THORChain revealed the deployment of the ZEC liquidity pool, emphasizing that all network nodes are now actively monitoring the Zcash blockchain. This development marks a significant milestone in integrating Zcash into THORChain’s decentralized cross-chain ecosystem.
THORChain is a cross-chain decentralized liquidity protocol that enables direct swaps between major blockchains without intermediaries. With the ZEC pool launched, Zcash now has a permissionless liquidity venue within the network.
Although the pool is now live, THORChain clarified that native ZEC trading is not yet available. The team identified enabling trading as the forthcoming phase, stating that liquidity remains shallow at this initial stage.
THORChain encouraged users to exercise caution in the early days due to limited liquidity, which can lead to higher slippage and greater price impact for larger trades. The protocol did not specify the current liquidity depth nor announce a date for activating native ZEC swaps.
The ZEC pool is now live on THORChain. The network has churned, and every node is monitoring the Zcash blockchain. Zcash now has a genuinely permissionless venue for liquidity, with trading set as the next step. Liquidity is shallow for now and is expected to grow over time, so caution is advised initially.
Zcash integration process and next stepsZEC’s integration follows months of technical preparation by the THORChain development team. In its v3.16.0 upgrade, the network introduced Zcash-specific UTXO management and refined remote procedure call logic to accommodate Zcash’s blockchain structure.
ZEC was also added to THORChain’s enshrined oracle, enabling the protocol to access native Zcash price data for its operations.
Development continued through September as engineers resolved inconsistencies in transaction signing related to Zcash’s unique transaction expiry mechanism. This required consensus among nodes on the specific blockchain height used for expiry, as well as improved handling of transaction retries to preserve key information.
THORChain’s recent adjustments ensure more reliable and consistent processing of ZEC transactions across the network.
The current activation forms part of a broader, phased integration for Zcash rather than a simple listing. Once native trading is enabled, users will be able to swap ZEC directly within THORChain without reliance on centralized exchanges.
It remains unclear whether shielded ZEC transactions will be supported in the new pool. THORChain has not made a definitive statement regarding this feature, leaving the scope of Zcash functionality open for now.
For now, ZEC has been added to THORChain’s live liquidity infrastructure. Activating direct trading and increasing liquidity remain the next goals for the protocol and its users.
Mini dictionary: Node churn: In decentralized networks like THORChain, “node churn” refers to the process of rotating or replacing active validator nodes to improve security, prevent collusion, and maintain network robustness.
Bitget’s attacker has moved much of the exchange’s $387.5 million theft toward Bitcoin through cross-chain services, while only around $840,000 had been publicly frozen five days after the Sept. 24 breach.
Summary
Bitget says attackers moved $387.5 million from hot and warm wallets across blockchains in September. BlockSec estimates attackers still controlled roughly $342 million five days after the Bitget theft began. Tether, Circle and NEAR Intents froze roughly $840,000, equal to only 0.2% of stolen funds. THORChain handled about $269 million in pass-through value, while Bitcoin became the main consolidation asset. North Korea remains suspected, but BlockSec says current onchain evidence does not establish attacker identity. BlockSec reported that the stolen funds followed three main paths: quickly converting assets that issuers could freeze, consolidating value from several chains into Bitcoin and gradually sending BTC into CoinJoin transactions.
The security firm based its analysis on addresses published through Bitget’s tracking dashboard and a Sept. 29 snapshot, meaning the balances and laundering totals can continue changing as funds move.
How did the Bitget hacker move the stolen money? Bitget said the breach began at 18:31 UTC on Sept. 24 with unauthorized transfers from portions of its hot and warm wallet infrastructure.
BlockSec found that the first transactions involved tiny test transfers of 0.84 ETH and 93 TRX. Larger withdrawals started at 18:58 UTC, while Bitget’s reconciliation system detected a discrepancy seven minutes later and blocked ordinary customer withdrawals.
The attackers were not relying on the normal customer withdrawal process, according to Bitget. The exchange said a vulnerability in a third-party security product gave the attackers high-level internal credentials, which were then used to submit forged withdrawal commands directly into its wallet system.
Private keys were not compromised, Bitget said, while its cold wallets remained unaffected. Independent investigations by Mandiant and SlowMist later confirmed that compromised third-party security software enabled unauthorized access to the exchange’s wallet environment.
The loss was initially estimated at $351.6 million before Bitget expanded the figure to roughly $387.5 million after accounting for Zcash and Tron transfers. BlockSec counted 13 stolen assets across 12 chains, with XRP representing the largest single-chain loss.
Assets that could be frozen were moved first. BlockSec found roughly $75.48 million in USDT, USDC and USDT0, plus 3,000 XAUt tokens, were converted into ETH or AVAX within 41 minutes of their theft.
Uniswap, UniswapX, 1inch and MetaMask’s built-in swap service appeared among the routes used. BlockSec said all those conversions were completed before Bitget CEO Gracy Chen publicly disclosed the breach.
Why has only $840K of Bitget’s $387M been frozen? Once the assets had been converted, the attacker began moving value between chains and toward Bitcoin.
BlockSec estimated that around $269 million in pass-through value moved through THORChain across 7,804 transactions by its Sept. 29 snapshot. Chainflip handled roughly $37.27 million, while USDT0/LayerZero, Circle’s CCTP, Across and Stargate appeared in other routes.
Those figures cannot be added together as separate stolen amounts. BlockSec cautioned that the same funds can move through more than one protocol while traveling between chains.
Nearly five days into the laundering process, BlockSec estimated attacker-controlled wallets still held approximately $342 million, equal to 88.3% of the original stolen amount. Bitcoin accounted for around 83.7% of that balance, or roughly 3,386 BTC.
Publicly visible freezes were much smaller.
Tether and Circle had immobilized around $340,000 in stablecoins. Much of that money became vulnerable to freezing because it remained at addresses long enough for the issuers to respond.
NEAR Intents separately said its SHIELD risk system caught attempts to route more than $50 million through the service. BlockSec’s review of the disclosure found roughly $503,000 was stopped during execution, while around $166,000 passed through.
The NEAR Intents figures carry an estimated error margin of up to 10%, according to the service’s own disclosure.
Earlier coverage of NEAR Intents blocking Bitget-linked transfers found that some funds were left in pending transactions after being flagged during the swap process.
Combined, the Tether, Circle and NEAR Intents actions put publicly visible frozen funds near $840,000, just 0.2% of the amount stolen.
Why did so much Bitget crypto move through THORChain? THORChain became the largest cross-chain route identified by BlockSec, drawing criticism from Bitget as stolen ETH continued to be converted into BTC.
Chen publicly asked THORChain to reject known attacker addresses, arguing that “decentralization is a design principle, not a shield” for stolen funds.
THORChain rejected the request and said its emergency halt functions are designed to protect the protocol as a whole, not selectively censor individual transactions.
The network said an emergency halt “is not a selective freeze” of a specific transaction or user.
A Bitget-linked wallet later swapped about $6.3 million of ETH into Bitcoin through THORChain, completing 27 swaps that produced approximately 75.2 BTC.
Other stolen funds reached Bitcoin mixers. BlockSec counted about $3.94 million entering CoinJoin transactions by Sept. 29.
One Sept. 27 CoinJoin transaction contained 356 inputs and 401 outputs. Four inputs, each containing 2.5 BTC, came from addresses Bitget’s tracker identified as belonging to the attacker.
Separate tracking of Bitget funds entering Wasabi CoinJoin previously found a route starting on Tron, passing through Ethereum and THORChain, then reaching Bitcoin before mixing.
Did North Korea carry out the Bitget hack? North Korean involvement remains an assessment, not a confirmed attribution by law enforcement.
Chen has said IP behavior and onchain patterns were “consistent with techniques used by DPRK-linked hacker groups.” Bitget said some IP addresses matched VPN infrastructure previously associated with a North Korean group, but the technical evidence behind that comparison has not been made public.
BlockSec found other possible links, including overlap with laundering methods used in attacks attributed to TraderTraitor and the use of THORChain to convert assets into Bitcoin.
Researcher ZachXBT identified several Chinese-speaking underground money launderers that he said were handling funds for the attacker. One had reportedly appeared in laundering activity connected with an earlier exploit.
Arkham separately pointed to the use of a peel-chain technique frequently associated with North Korean-linked operations.
BlockSec cautioned against treating those similarities as proof of attacker identity. Money-laundering services can work for different clients, while protocols such as THORChain and CoinJoin are available to unrelated users.
The security firm said the evidence points more directly to possible reuse of laundering groups than proof that the same hackers carried out earlier North Korean-linked attacks.
The comparison has centered partly on the 2025 Bybit theft. U.S. authorities formally attributed that $1.5 billion attack to North Korea’s TraderTraitor operation, while THORChain was heavily used to move the stolen Bybit funds.
No law-enforcement agency has publicly attributed the Bitget breach to North Korea as of the latest verified updates.
What happens next for Bitget and the stolen funds? Bitget continues to trace wallets and is offering a bounty for recoveries. The exchange offers qualifying participants 5% of funds they directly help freeze and another 5% for funds successfully recovered.
The Bitget recovery bounty was launched while Mandiant, SlowMist, exchanges and blockchain investigators continued tracking attacker addresses.
Bitget has already restored Bitcoin, Ether and USDT withdrawals in phases. Its published schedule places other tokens, fiat withdrawals and P2P services at 08:00 UTC on Oct. 2, although the exchange’s official incident page had not yet posted a separate confirmation of that final reopening when checked.
Bitget says the exploited vulnerability has been fixed and user balances remain unaffected. Its forensic investigation, law-enforcement work, fund tracing and recovery effort remain open, while the exchange says further material findings will be published through its official security updates.
THORChain announced its ZEC liquidity pool is now live, with the network having completed a node churn and all nodes starting to monitor the Zcash blockchain. The protocol noted that trading functionality will be its next step, adding that current liquidity remains shallow, so early trades should watch for risks such as slippage. Earlier, THORChain added native Zcash support via protocol upgrades, including UTXO processing, RPC logic, and the ZEC price oracle, and has been steadily advancing mainnet integration.
After Bitget got hacked on Sept. 24, $387.5 million of stolen funds quickly began moving across chains, with some headed to decentralized cross chain swaps platform THORChain.
Chief executive Gracy Chen publicly appealed to the platform to refuse service to attacker-linked addresses. “The industry is watching,” she said.
Yet THORChain refused. And that refusal has kicked off a furious debate between those who believe protocols have a moral obligation to block stolen funds, and those hold the cypherpunk ideals of decentralized, permissionless technology sacrosanct.
Having previously watched on as the Bybit hackers funneled $1.2 billion through the protocol, it’s pretty clear which side of the argument THORChain is on. Developer Boone Wheeler tells Magazine:
“A truly permissionless protocol can do nothing when it encounters known stolen funds — it is blind to their provenance. If THORChain were able to block specific stolen funds, it would not be permissionless.”Where does permissionlessness end? Critics argue that THORChain wasn’t quite so idealistic when validators voted to halt the chain in May after an automated system triggered when an attacker exploited a vulnerability and drained over $10 million from one of its vaults.
Bitget CEO argues THORChain should refuse services. Source: Gracy Chen
NEAR Intents, which is a cross-chain transaction competitor of THORChain, took the opposite approach and intervened to block hack-linked funds. Its automated security layer SHIELD identified more than $50 million in attempted flows linked to the Bitget incident and stopped $503,000 during execution. It said $166,000 passed through.
NEAR also waived its share of Bitget’s recovery bounty. General manager Alex Shevchenko tells Magazine, “NEAR Protocol is permissionless: anyone can build on it, transact on it, and become a validator…
“No one needs permission to hold or transfer assets or deploy contracts on NEAR Protocol. However, that does not mean every application built on NEAR must process every request.”NEAR Intents has since come under heavy fire for intervening, with critics arguing it demonstrates it is not permissionless or decentralized. This may expose it to claims it should exercise that control more broadly. However, because SHIELD is an automated system, crypto lawyer Yuriy Brisov believes it could still fall within the protections afforded to decentralized protocols.
“There is no compliance team, people who sit there and control the operation manually. This is a smart solution, and that’s what we recommend to all the DeFi companies.”Source: Omid Malekan
Permissionless does not necessarily mean neutral Biget’s Chen tells Magazine that while she understands different protocols have “different architectures, governance models and technical capabilities,” there is an important distinction between permissionless infrastructure and “facilitating the movement of known stolen funds.”
She points to NEAR Intents’ actions and says, “We appreciate that response and will follow the appropriate legal and recovery process for those assets.”
Bitget wants to understand “what is technically and governance-wise possible when stolen assets are identified,” Chen says, and whether the industry can find workable approaches together:
“Permissionless infrastructure does not necessarily mean there can be no mechanisms for detecting and responding to known illicit flows.” Complicating THORChain’s argument, it has shown it can intervene in an emergency if it chooses to.
THORChain’s post-mortem of the May exploit said the protocol automatically halts activity when its solvency checks detect an insolvency event, and node operators can then use broader emergency controls to pause trading, signing and other network activity.
Wheeler says there is “firm consensus” among THORChain’s nodes around the ideal of being permissionless, and that “halts are only used when there is an active issue or problem with the protocol.”
Moreover, he says there is “no functionality to screen individual addresses or transactions.” This is a design choice, as the system was “intentionally designed to be truly permissionless.”
THORChain halted its chain in May over a security incident. Source: THORChain
NEAR Intents provides a contrasting modelWhile THORChain is located at the shadowy super-coder end of the spectrum, the NEAR team occupies the middle ground. NEAR has a new ETF from Bitwise and has a different philosophy and approach.
Shevchenko says NEAR Intents was designed to enable open participation but has its own financial integrity measures, and SHIELD is built to “automatically apply targeted controls to supported flows.”
In this incident, he says SHIELD used public onchain data and signals from an internal anti-money laundering (AML) database and third-party intelligence providers, such as those listed in the NEAR Intents risk and compliance docs.
“SHIELD not only protects NEAR Intents but the whole cross-chain ecosystem it serves,” Shevchenko says:
“Every major hack drains capital and activity from the onchain economy, so screening for stolen funds and restricting money laundering helps protect the integrity of the wider blockchain economy.”In fact, the AI-based SHIELD identified the suspicious behavior behind Thursday’s $3.8 million Omni deposit/withdrawal interaction exploit, and halted activity.
Chen says when stolen funds can be reliably identified, ecosystem participants “should cooperate where technically and legally possible.”
That could mean tracing and information sharing, declining transactions, freezing assets where the infrastructure allows it, or “supporting recovery through the appropriate legal and law enforcement processes.”
The cost of drawing the line Joël Valenzuela, a libertarian, cypherpunk and head of business and development for Dash, argues that permissionless means exactly that.
“Permissionless protocols, quite frankly, should not draw the line anywhere when stolen funds are identified, because being able to do so at all makes them permissioned.”He says that, as “painful” as it is to watch stolen funds freely moved, the ability to step in and prevent this “opens up Pandora’s Box” and “lets all manner of censorship of innocents eventually happen.” Instead, centralized exchanges should harden security protocols, he says:
“High-level exchanges custodying billions of dollars need to take their security much more seriously. Ultimately, DEXs are the way forward.”Max Shannon, senior research associate at Bitwise Europe, says that protocols still in their formative years, like THORChain and NEAR, still have to earn trust and that refusing to launder hack proceeds is a “sound stance.”
He believes THORChain’s actions will likely result in more money laundering flows shifting from NEAR Intents to THORChain.
Valenzuela argues we must hold the line on permissionlessness. Source: Joël Valenzuela
“Credible neutrality at all costs,” Shannon says, is a “cypherpunk ideal” that a small faction of crypto users and builders still champion.
“They rarely ask why it is valuable, when it is valuable, or what it costs,” he says. “This is the core difference between NEAR Intents and THORChain.”
Magazine: Altseason is coming — and traders are more discerning this time
Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.
After Bitget got hacked on Sept. 24, $387.5 million of stolen funds quickly began moving across chains, with some headed to decentralized cross chain swaps platform THORChain.
Chief executive Gracy Chen publicly appealed to the platform to refuse service to attacker-linked addresses. “The industry is watching,” she said.
Yet THORChain refused. And that refusal has kicked off a furious debate between those who believe protocols have a moral obligation to block stolen funds, and those hold the cypherpunk ideals of decentralized, permissionless technology sacrosanct.
Having previously watched on as the Bybit hackers funneled $1.2 billion through the protocol, it’s pretty clear which side of the argument THORChain is on. Developer Boone Wheeler tells Magazine:
“A truly permissionless protocol can do nothing when it encounters known stolen funds — it is blind to their provenance. If THORChain were able to block specific stolen funds, it would not be permissionless.”Where does permissionlessness end? Critics argue that THORChain wasn’t quite so idealistic when validators voted to halt the chain in May after an automated system triggered when an attacker exploited a vulnerability and drained over $10 million from one of its vaults.
Bitget CEO argues THORChain should refuse services. Source: Gracy Chen
NEAR Intents, which is a cross-chain transaction competitor of THORChain, took the opposite approach and intervened to block hack-linked funds. Its automated security layer SHIELD identified more than $50 million in attempted flows linked to the Bitget incident and stopped $503,000 during execution. It said $166,000 passed through.
NEAR also waived its share of Bitget’s recovery bounty. General manager Alex Shevchenko tells Magazine, “NEAR Protocol is permissionless: anyone can build on it, transact on it, and become a validator…
“No one needs permission to hold or transfer assets or deploy contracts on NEAR Protocol. However, that does not mean every application built on NEAR must process every request.”NEAR Intents has since come under heavy fire for intervening, with critics arguing it demonstrates it is not permissionless or decentralized. This may expose it to claims it should exercise that control more broadly. However, because SHIELD is an automated system, crypto lawyer Yuriy Brisov believes it could still fall within the protections afforded to decentralized protocols.
“There is no compliance team, people who sit there and control the operation manually. This is a smart solution, and that’s what we recommend to all the DeFi companies.”Source: Omid Malekan
Permissionless does not necessarily mean neutral Biget’s Chen tells Magazine that while she understands different protocols have “different architectures, governance models and technical capabilities,” there is an important distinction between permissionless infrastructure and “facilitating the movement of known stolen funds.”
She points to NEAR Intents’ actions and says, “We appreciate that response and will follow the appropriate legal and recovery process for those assets.”
Bitget wants to understand “what is technically and governance-wise possible when stolen assets are identified,” Chen says, and whether the industry can find workable approaches together:
“Permissionless infrastructure does not necessarily mean there can be no mechanisms for detecting and responding to known illicit flows.” Complicating THORChain’s argument, it has shown it can intervene in an emergency if it chooses to.
THORChain’s post-mortem of the May exploit said the protocol automatically halts activity when its solvency checks detect an insolvency event, and node operators can then use broader emergency controls to pause trading, signing and other network activity.
Wheeler says there is “firm consensus” among THORChain’s nodes around the ideal of being permissionless, and that “halts are only used when there is an active issue or problem with the protocol.”
Moreover, he says there is “no functionality to screen individual addresses or transactions.” This is a design choice, as the system was “intentionally designed to be truly permissionless.”
THORChain halted its chain in May over a security incident. Source: THORChain
NEAR Intents provides a contrasting modelWhile THORChain is located at the shadowy super-coder end of the spectrum, the NEAR team occupies the middle ground. NEAR has a new ETF from Bitwise and has a different philosophy and approach.
Shevchenko says NEAR Intents was designed to enable open participation but has its own financial integrity measures, and SHIELD is built to “automatically apply targeted controls to supported flows.”
In this incident, he says SHIELD used public onchain data and signals from an internal anti-money laundering (AML) database and third-party intelligence providers, such as those listed in the NEAR Intents risk and compliance docs.
“SHIELD not only protects NEAR Intents but the whole cross-chain ecosystem it serves,” Shevchenko says:
“Every major hack drains capital and activity from the onchain economy, so screening for stolen funds and restricting money laundering helps protect the integrity of the wider blockchain economy.”In fact, the AI-based SHIELD identified the suspicious behavior behind Thursday’s $3.8 million Omni deposit/withdrawal interaction exploit, and halted activity.
Chen says when stolen funds can be reliably identified, ecosystem participants “should cooperate where technically and legally possible.”
That could mean tracing and information sharing, declining transactions, freezing assets where the infrastructure allows it, or “supporting recovery through the appropriate legal and law enforcement processes.”
The cost of drawing the line Joël Valenzuela, a libertarian, cypherpunk and head of business and development for Dash, argues that permissionless means exactly that.
“Permissionless protocols, quite frankly, should not draw the line anywhere when stolen funds are identified, because being able to do so at all makes them permissioned.”He says that, as “painful” as it is to watch stolen funds freely moved, the ability to step in and prevent this “opens up Pandora’s Box” and “lets all manner of censorship of innocents eventually happen.” Instead, centralized exchanges should harden security protocols, he says:
“High-level exchanges custodying billions of dollars need to take their security much more seriously. Ultimately, DEXs are the way forward.”Max Shannon, senior research associate at Bitwise Europe, says that protocols still in their formative years, like THORChain and NEAR, still have to earn trust and that refusing to launder hack proceeds is a “sound stance.”
He believes THORChain’s actions will likely result in more money laundering flows shifting from NEAR Intents to THORChain.
Valenzuela argues we must hold the line on permissionlessness. Source: Joël Valenzuela
“Credible neutrality at all costs,” Shannon says, is a “cypherpunk ideal” that a small faction of crypto users and builders still champion.
“They rarely ask why it is valuable, when it is valuable, or what it costs,” he says. “This is the core difference between NEAR Intents and THORChain.”
Magazine: Altseason is coming — and traders are more discerning this time
Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.
TLDR THORChain activated Zcash (ZEC) pool support on October 2 following a complete node churn across its network. Every active validator now tracks the Zcash blockchain, though native swaps have not yet been enabled. The team cautioned that pool depth remains limited in these initial stages and recommended trader vigilance. Integration required months of technical work including UTXO management, RPC implementation and oracle integration for ZEC pricing. The rollout occurs while THORChain faces questions about its handling of assets connected to the Bitget security breach. THORChain has activated support for its Zcash liquidity pool. The deployment was confirmed on October 2 after the protocol finalized a comprehensive node rotation.
The $ZEC pool is now live on THORChain.
The network churned and every node is watching the Zcash chain. @Zcash now has a truly permissionless venue.
Trading is the next step. Liquidity is shallow for now and will grow over time, so trade with caution in the early days. pic.twitter.com/sVEj0K4xNQ
— THORChain (@THORChain) October 2, 2026
All operational validators across THORChain’s network are now actively observing the Zcash blockchain. While trading functionality remains offline, the protocol indicated it represents the immediate next milestone.
In its public statement, THORChain made clear that swap activity is forthcoming. The pool deployment and the activation of user-facing trades are distinct implementation phases.
Pool Depth Limited During Initial Phase THORChain issued guidance to users regarding the current state of the newly deployed pool. The protocol acknowledged that available liquidity is currently limited and will expand gradually.
Users were encouraged to exercise care during the initial period of ZEC operations. The October 2 announcement did not include specific figures for pool capacity or a confirmed timeline for enabling trades.
A network monitoring interface displaying THORChain’s active validators now shows ZEC operating with normal status. It is listed among Bitcoin, Ethereum and other integrated blockchains.
Extended Technical Work Preceded Launch The Zcash integration represents the culmination of significant development efforts. A March 4 protocol enhancement introduced chain-specific UTXO management and RPC functionality tailored for ZEC.
That identical upgrade integrated Zcash into the protocol’s oracle infrastructure. This enabled the network to conduct native price discovery for the asset.
A subsequent GitLab patch resolved a complication with ZEC network fee calculations. Engineers noted that an earlier implementation could artificially increase gas tolerance parameters during specific solvency checks.
Development activity extended through September. A THORNode code merge corrected signing discrepancies that emerged when validators computed transaction expiration from varying local chain states.
The solution anchored transaction expiration to a consensus ZEC block height. This approach ensured signing consistency across all validators during retry attempts and system restarts.
On September 17, THORChain confirmed that Zcash would be the next blockchain integrated into production. This followed an interval during which the project prioritized network reliability over expanding chain support.
Zcash’s UTXO architecture demanded additional configuration efforts. THORChain required parameters for address verification, gas calculations, minimum output thresholds, block intervals and coinbase rules before deployment could proceed.
The pool activation coincides with heightened scrutiny of THORChain’s involvement in processing compromised assets. Bitget revealed a security incident beginning September 24, subsequently increasing the estimated value transferred to attacker wallets to approximately $387.5 million.
Bitget indicated the figure encompassed Zcash and Tron transactions identified by forensic analysts. The platform enumerated affected tokens including XRP, ETH, USDT, ZEC, USDC, XAUt, BNB, AVAX and TRX.
Investigation findings suggest a wallet associated with the Bitget perpetrator executed 27 exchanges via THORChain. These transactions converted approximately 2,390 ETH into 75.2 BTC, valued at roughly $6.3 million at execution.
Bitget had requested that THORChain prevent transactions originating from addresses linked to the attacker. THORChain refused, explaining that its emergency mechanisms can halt a blockchain or the entire protocol but lack the capability to isolate individual addresses or transactions.
THORChain articulated its stance in an October 1 blog entry. The project stated that substantial protocol modifications demand a two-thirds supermajority among validator operators.
This marks not the first occasion THORChain has encountered such examination. Following the February 2025 Bybit compromise, Bybit’s CEO stated that 72% of approximately $900 million in laundered stolen assets transited through THORChain.
Bitget’s asset recovery portal currently displays attacker wallet addresses spanning multiple networks, including Zcash. The exchange has posted a 5% reward for assistance resulting in asset freezing or recovery.
At present, THORChain’s Zcash pool is operational, though native swap functionality has not been activated.
After suspected North Korean hackers exploited crypto exchange Bitget for $387.5 million last week, investigators were able to quickly flag and trace the recipient addresses.
Bitget CEO Gracy Chen then controversially demanded that decentralized cross-chain swaps platform THORChain “refuse service to these addresses.”
THORChain responded:
“THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?”The move was controversial, especially given the protocol was halted immediately in May when $10.7 million of its own funds were exploited. Complicating matters, THORChain has retired its admin key and claims it doesn’t have an easy way to censor addresses, even if it wanted to.
Source: THORChain
This exact controversy has come up before, as THORChain was used to swap around $1.2 billion of the funds stolen in the $1.46 billion hack of Bybit. It just so happened that THORChain’s admin key had been retired just 11 days earlier.
NEAR Intents took the opposite approach to THORChain. Its automated SHIELD program blocked addresses linked to the hack from swapping $50 million on the platform, and even turned down the 5% bounty Bitget was offering for doing so.
Now NEAR Intents is under fire from decentralization maxis for not being permissionless enough.
To discuss the legal issues involved in the case, Magazine spoke with Yuriy Brisov from D&A Partners. This is an edited version of the conversation.
Magazine: Bitget asked THORChain to block funds tied to the hack, and it responded saying it’s decentralized and permissionless. Is that a legal defense? Do they have an obligation to block those addresses?
Brisov: It depends on the level of decentralization. So when they do this — when they block some addresses — they show that their nodes aren’t truly decentralized. It’s good for the community, when they can use this power to prevent some malicious activities. However, at the same time, they open themselves to any other legal claim. Their only protection is “we are decentralized.”
In the Uniswap case, they said ‘we are truly decentralized and there is nothing we can do.’ [Investors sued Uniswap after buying 38 rugpull and scam tokens, but a judge dismissed the case in March —Ed.]
And this is the strongest defense for any DeFi protocol. If they show that they can block, control, or somehow interfere — even in a good faith attempt to prevent fraud — they still open themselves for these kinds of claims. That if you have control, then maybe your control shouldn’t be limited to only obvious fraud cases. You should imply [control over] due diligence matters. You should apply KYC and AML protective measures.
Magazine: NEAR Intents blocked those addresses, and Bitget thanked them for doing so. Does that mean NEAR has shown Intents is not decentralized and will therefore need to interfere in lots of other situations?
If you show that you have control over assets, then you potentially open yourself to all potential claims regarding pump-and-dump schemes, volatility, or any other potential claims of any investors who somehow have been damaged and harmed. And they can now say that you have control. Why do you use it in one case and not use it in another case? Why don’t you check all your token issuers on your platform? Why don’t they provide KYC forms like on any centralized exchange?
Source: Gracy Chen
Magazine: THORChain argues the protocol halt in May was initially triggered by an automated system and that they don’t have the ability to block certain addresses. If true, is that a defense?
Brisov: It might be. We don’t know yet, because it hasn’t been challenged yet. But any amount of control makes any DeFi project weaker vis-à-vis any claimant.
Magazine: On the other hand, the protocol could upgrade the software if it wished to block certain addresses. Could a project get in legal trouble for being reckless or negligent if they don’t impose something like that?
It depends on how it’s been done from the technical side. Say there is an oracle that can detect any North Korean IP and block it automatically, and there is no person who sits and presses a button — “there’s a North Korean hacker, let’s block him.” Then it’s okay.
If there is a team that oversees the situation and says, “Okay, we can see this is an illicit activity, we block these addresses, we press the button manually.” From the legal point of view, even though it’s a good act and it benefits the community, it still makes the project not fully decentralized from the legal perspective, and it strips you of the protection that regulations like MiCA [EU’s Markets in Crypto Assets laws] or the general understanding the SEC and CFTC provide that if you’re fully decentralized, you cannot be liable for the actions of the participants in your ecosystem.
Source: Alex Shevchenko
Magazine: NEAR’s technology is called SHIELD and it’s an automated process that identifies addresses associated with known hacks on public blockchains and then blocks them from accessing Intents automatically. Does that mean it’s more likely to be seen as decentralized?
Brisov: Definitely. They show that they are good-faith actors trying to [add] protective measures into their protocols. There is no compliance team, people who sit there and control the operation manually. This is a smart solution, and that’s what we recommend to all the DeFi companies.
Magazine: In February 2025, THORChain retired the admin key which would allow the core team to make those sorts of unilateral changes. With the lack of an admin key and the fact they’ve got a hundred validators, does that make them sufficiently decentralized?
Brisov: More likely than not, but we can’t say that for sure. I would say yes.
Magazine: THORChain is not a mixer. You can take stolen Bitget funds and swap them on THORChain, but when it comes out the other end, it will still be transparently linked to the Bitget hackers. How does that fit the definition of money laundering? Or is it receiving stolen goods?
Brisov: I don’t see how they can be liable for money laundering because even Tornado Cash, that was, to a certain extent, made to launder money [avoided US sanctions as immutable smart contracts are not sanctionable property in terms of money laundering—Ed].
American law treats something as either property or not property. And money laundering is illegally moving property through the legal channels. You make proceeds of illicit activity, and it’s property, and then you move it through some channels and try to make it legal. But smart contracts are not property at all. You don’t control them. You don’t own them. That’s how Tornado Cash won their case in court vis-à-vis OFAC sanctions. They just proved that they don’t have any control over their smart contracts.
Magazine: The Bybit hack happened 18 months ago. Does that mean that no legal action is going to be taken against THORChain, or do these cases just take a long time?
Brisov: It might happen in the future, definitely. After the Bybit case, they seriously opened themselves for potential claims.
Magazine: Big Questions: Does Satoshi actually own 1.1 million Bitcoin?
Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.
After suspected North Korean hackers exploited crypto exchange Bitget for $387.5 million last week, investigators were able to quickly flag and trace the recipient addresses.
Bitget CEO Gracy Chen then controversially demanded that decentralized cross-chain swaps platform THORChain “refuse service to these addresses.”
THORChain responded:
“THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?”The move was controversial, especially given the protocol was halted immediately in May when $10.7 million of its own funds were exploited. Complicating matters, THORChain has retired its admin key and doesn’t have an easy way to censor addresses, even if it wanted to.
Source: THORChain
This exact controversy has come up before, as THORChain was used to swap around $1.2 billion of the funds stolen in the $1.46 billion hack of Bybit. It just so happened that THORChain’s admin key had been retired just 11 days earlier.
NEAR Intents took the opposite approach to THORChain. Its automated SHIELD program blocked addresses linked to the hack from swapping $50 million on the platform, and even turned down the 5% bounty Bitget was offering for doing so.
Now NEAR Intents is under fire from decentralization maxis for not being permissionless enough.
To discuss the legal issues involved in the case, Magazine spoke with Yuriy Brisov from D&A Partners. This is an edited version of the conversation.
Magazine: Bitget asked THORChain to block funds tied to the hack, and it responded saying it’s decentralized and permissionless. Is that a legal defense? Do they have an obligation to block those addresses?
Brisov: It depends on the level of decentralization. So when they do this — when they block some addresses — they show that their nodes aren’t truly decentralized. It’s good for the community, when they can use this power to prevent some malicious activities. However, at the same time, they open themselves to any other legal claim. Their only protection is “we are decentralized.”
In the Uniswap case, they said ‘we are truly decentralized and there is nothing we can do.’ [Investors sued Uniswap after buying 38 rugpull and scam tokens, but a judge dismissed the case in March —Ed.]
And this is the strongest defense for any DeFi protocol. If they show that they can block, control, or somehow interfere — even in a good faith attempt to prevent fraud — they still open themselves for these kinds of claims. That if you have control, then maybe your control shouldn’t be limited to only obvious fraud cases. You should imply [control over] due diligence matters. You should apply KYC and AML protective measures.
Magazine: NEAR Intents blocked those addresses, and Bitget thanked them for doing so. Does that mean NEAR has shown Intents is not decentralized and will therefore need to interfere in lots of other situations?
If you show that you have control over assets, then you potentially open yourself to all potential claims regarding pump-and-dump schemes, volatility, or any other potential claims of any investors who somehow have been damaged and harmed. And they can now say that you have control. Why do you use it in one case and not use it in another case? Why don’t you check all your token issuers on your platform? Why don’t they provide KYC forms like on any centralized exchange?
Source: Gracy Chen
Magazine: THORChain argues the protocol halt in May initially triggered by an automated system and that they don’t have the ability to block certain addresses. If true, is that a defense?
Brisov: It might be. We don’t know yet, because it hasn’t been challenged yet. But any amount of control makes any DeFi project weaker vis-à-vis any claimant.
Magazine: On the other hand, the protocol could upgrade the software if it wished to block certain addresses. Could a project get in legal trouble for being reckless or negligent if they don’t impose something like that?
It depends on how it’s been done from the technical side. Say there is an oracle that can detect any North Korean IP and block it automatically, and there is no person who sits and presses a button — “there’s a North Korean hacker, let’s block him.” Then it’s okay.
If there is a team that oversees the situation and says, “Okay, we can see this is an illicit activity, we block these addresses, we press the button manually.” From the legal point of view, even though it’s a good act and it benefits the community, it still makes the project not fully decentralized from the legal perspective, and it strips you of the protection that regulations like MiCA [EU’s Markets in Crypto Assets laws] or the general understanding the SEC and CFTC provide that if you’re fully decentralized, you cannot be liable for the actions of the participants in your ecosystem.
Source: Alex Shevchenko
Magazine: NEAR’s technology is called SHIELD and it’s an automated process that identifies addresses associated with known hacks on public blockchains and then blocks them from accessing Intents automatically. Does that mean it’s more likely to be seen as decentralized?
Brisov: Definitely. They show that they are good-faith actors trying to [add] protective measures into their protocols. There is no compliance team, people who sit there and control the operation manually. This is a smart solution, and that’s what we recommend to all the DeFi companies.
Magazine: In February 2025, THORChain retired the admin key which would allow them to make those sorts of unilateral changes. With the lack of an admin key and the fact they’ve got a hundred validators, does that make them sufficiently decentralized?
Brisov: More likely than not, but we can’t say that for sure. I would say yes.
Magazine: THORChain is not a mixer. You can take stolen Bitget funds and swap them on THORChain, but when it comes out the other end, it will still be transparently linked to the Bitget hackers. How does that fit the definition of money laundering? Or is it receiving stolen goods?
Brisov: I don’t see how they can be liable for money laundering because even Tornado Cash, that was, to a certain extent, made to launder money [avoided US sanctions as immutable smart contracts are not sanctionable property in terms of money laundering—Ed].
American law treats something as either property or not property. And money laundering is illegally moving property through the legal channels. You make proceeds of illicit activity, and it’s property, and then you move it through some channels and try to make it legal. But smart contracts are not property at all. You don’t control them. You don’t own them. That’s how Tornado Cash won their case in court vis-à-vis OFAC sanctions. They just proved that they don’t have any control over their smart contracts.
Magazine: The Bybit hack happened 18 months ago. Does that mean that no legal action is going to be taken against THORChain, or do these cases just take a long time?
Brisov: It might happen in the future, definitely. After the Bybit case, they seriously opened themselves for potential claims.
Magazine: Big Questions: Does Satoshi actually own 1.1 million Bitcoin?
Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.
After suspected North Korean hackers exploited crypto exchange Bitget for $387.5 million last week, investigators were able to quickly flag and trace the recipient addresses.
Bitget CEO Gracy Chen then controversially demanded that decentralized cross-chain swaps platform THORChain “refuse service to these addresses.”
THORChain responded:
“THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?”The move was controversial, especially given the protocol was halted immediately in May when $10.7 million of its own funds were exploited. Complicating matters, THORChain has retired its admin key and doesn’t have an easy way to censor addresses, even if it wanted to.
Source: THORChain
This exact controversy has come up before, as THORChain was used to swap around $1.2 billion of the funds stolen in the $1.46 billion hack of Bybit. It just so happened that THORChain’s admin key had been retired just 11 days earlier.
NEAR Intents took the opposite approach to THORChain. Its automated SHIELD program blocked addresses linked to the hack from swapping $50 million on the platform, and even turned down the 5% bounty Bitget was offering for doing so.
Now NEAR Intents is under fire from decentralization maxis for not being permissionless enough.
To discuss the legal issues involved in the case, Magazine spoke with Yuriy Brisov from D&A Partners. This is an edited version of the conversation.
Magazine: Bitget asked THORChain to block funds tied to the hack, and it responded saying it’s decentralized and permissionless. Is that a legal defense? Do they have an obligation to block those addresses?
Brisov: It depends on the level of decentralization. So when they do this — when they block some addresses — they show that their nodes aren’t truly decentralized. It’s good for the community, when they can use this power to prevent some malicious activities. However, at the same time, they open themselves to any other legal claim. Their only protection is “we are decentralized.”
In the Uniswap case, they said ‘we are truly decentralized and there is nothing we can do.’ [Investors sued Uniswap after buying 38 rugpull and scam tokens, but a judge dismissed the case in March —Ed.]
And this is the strongest defense for any DeFi protocol. If they show that they can block, control, or somehow interfere — even in a good faith attempt to prevent fraud — they still open themselves for these kinds of claims. That if you have control, then maybe your control shouldn’t be limited to only obvious fraud cases. You should imply [control over] due diligence matters. You should apply KYC and AML protective measures.
Magazine: NEAR Intents blocked those addresses, and Bitget thanked them for doing so. Does that mean NEAR has shown Intents is not decentralized and will therefore need to interfere in lots of other situations?
If you show that you have control over assets, then you potentially open yourself to all potential claims regarding pump-and-dump schemes, volatility, or any other potential claims of any investors who somehow have been damaged and harmed. And they can now say that you have control. Why do you use it in one case and not use it in another case? Why don’t you check all your token issuers on your platform? Why don’t they provide KYC forms like on any centralized exchange?
Source: Gracy Chen
Magazine: THORChain argues the protocol halt in May initially triggered by an automated system and that they don’t have the ability to block certain addresses. If true, is that a defense?
Brisov: It might be. We don’t know yet, because it hasn’t been challenged yet. But any amount of control makes any DeFi project weaker vis-à-vis any claimant.
Magazine: On the other hand, the protocol could upgrade the software if it wished to block certain addresses. Could a project get in legal trouble for being reckless or negligent if they don’t impose something like that?
It depends on how it’s been done from the technical side. Say there is an oracle that can detect any North Korean IP and block it automatically, and there is no person who sits and presses a button — “there’s a North Korean hacker, let’s block him.” Then it’s okay.
If there is a team that oversees the situation and says, “Okay, we can see this is an illicit activity, we block these addresses, we press the button manually.” From the legal point of view, even though it’s a good act and it benefits the community, it still makes the project not fully decentralized from the legal perspective, and it strips you of the protection that regulations like MiCA [EU’s Markets in Crypto Assets laws] or the general understanding the SEC and CFTC provide that if you’re fully decentralized, you cannot be liable for the actions of the participants in your ecosystem.
Source: Alex Shevchenko
Magazine: NEAR’s technology is called SHIELD and it’s an automated process that identifies addresses associated with known hacks on public blockchains and then blocks them from accessing Intents automatically. Does that mean it’s more likely to be seen as decentralized?
Brisov: Definitely. They show that they are good-faith actors trying to [add] protective measures into their protocols. There is no compliance team, people who sit there and control the operation manually. This is a smart solution, and that’s what we recommend to all the DeFi companies.
Magazine: In February 2025, THORChain retired the admin key which would allow them to make those sorts of unilateral changes. With the lack of an admin key and the fact they’ve got a hundred validators, does that make them sufficiently decentralized?
Brisov: More likely than not, but we can’t say that for sure. I would say yes.
Magazine: THORChain is not a mixer. You can take stolen Bitget funds and swap them on THORChain, but when it comes out the other end, it will still be transparently linked to the Bitget hackers. How does that fit the definition of money laundering? Or is it receiving stolen goods?
Brisov: I don’t see how they can be liable for money laundering because even Tornado Cash, that was, to a certain extent, made to launder money [avoided US sanctions as immutable smart contracts are not sanctionable property in terms of money laundering—Ed].
American law treats something as either property or not property. And money laundering is illegally moving property through the legal channels. You make proceeds of illicit activity, and it’s property, and then you move it through some channels and try to make it legal. But smart contracts are not property at all. You don’t control them. You don’t own them. That’s how Tornado Cash won their case in court vis-à-vis OFAC sanctions. They just proved that they don’t have any control over their smart contracts.
Magazine: The Bybit hack happened 18 months ago. Does that mean that no legal action is going to be taken against THORChain, or do these cases just take a long time?
Brisov: It might happen in the future, definitely. After the Bybit case, they seriously opened themselves for potential claims.
Magazine: Big Questions: Does Satoshi actually own 1.1 million Bitcoin?
Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.
