THORChain Linked to Billions in Stolen Crypto Proceeds
The decentralized exchange currently lacks mechanisms to block illicit transactions, attracting global security scrutiny.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Should decentralized finance protocols be required to block transactions linked to stolen assets?
THORChain, a protocol designed for cross-chain asset swaps, has been linked to the movement of stolen funds from high-profile crypto platform breaches. Investigator ZachXBT reported that assets from hacks targeting Binance, Bybit, and Bitget were moved through the platform, which currently lacks a mechanism to block individual swaps.
Why it matters
The usage of decentralized protocols like THORChain for laundering proceeds from multi-billion dollar hacks presents a significant regulatory and operational challenge. Because the platform allows for permissionless cross-chain transactions, it has become a central node for obscuring the provenance of illicit assets.
THORChain facilitates liquidity-based swaps across distinct blockchains without a centralized intermediary. While the protocol inherently lacks individual address filtering, node operators retain the authority to halt network-wide trading.
The players
THORChain
A decentralized liquidity protocol that enables non-custodial swaps across multiple disparate blockchain networks.
ZachXBT
A well-known blockchain investigator who tracks illicit fund movements and identifies malicious actor activities across decentralized finance.
The details
THORChain functions as a decentralized exchange protocol that uses automated market makers—math-based pricing algorithms that enable direct asset swaps—to allow users to trade across different blockchains. Stolen funds from major exploits, such as the $6.3 billion Binance hack, have been traced as they converge at a single Ethereum address. The protocol structure currently prioritizes continuous liquidity, meaning there is no programmatic filter to block specific transactions or addresses.
Timeline
February 2025: Bybit hack occurred.
September 2026: Bitget hack occurred.
October 30, 2026: RUNE token price rose 13 percent.
The Tech Race
The reliance on THORChain for moving billions in stolen crypto highlights the ongoing tension between permissionless architecture and institutional security standards. This incident places the protocol in the same regulatory spotlight previously occupied by privacy-focused mixers that have been systematically targeted by authorities.
Users interacting with the protocol should be aware that the platform currently lacks the ability to filter transactions, which may invite future regulatory intervention. Investors in the RUNE token remain subject to high volatility often correlated with news of network utility or platform-related controversy.
The takeaway
The protocol’s inability to block specific transactions remains a critical design constraint that security analysts are actively monitoring. Watch for potential governance proposals from node operators regarding future security measures or a decision to pause network trading in response to continued illicit inflow.
Further reading
For broader trends in digital asset security and protocol vulnerability, explore the Cybersecurity section.
Live Poll
Should decentralized finance protocols be required to block transactions linked to stolen assets?
