THORChain Generated Over $5.5 Million in Revenue After Processing More Than $540M in Swap Volume

This activity spike came after the protocol was used to move funds stolen in the $1.4 billion Bybit hack.

A massive spike in activity on the THORChain protocol is being linked to the integration of funds stolen in the $1.4 billion Bybit hack.

The Bybit exchange was hacked for $1.4 billion worth of cryptocurrency on February 21. This breach is now considered the largest in crypto history.

The hack has been linked to the North Korean state-affiliated Lazarus Group by blockchain security firms. The hackers have been moving the stolen funds through various channels.

One major channel for these transfers is THORChain, a decentralized protocol that allows users to swap cryptocurrencies across different blockchains.

The protocol processed a record $4.66 billion in swaps in the week ending March 2. On a single day following the Bybit hack, THORChain’s swap volume exceeded $1 billion.

This activity generated over $554,000 in income for the protocol in just 24 hours.

THORChain just helped North Korea launder $605 million. No KYC, no off switch, no resistance.

Lazarus Group jacked Bybit for $1.5 billion in February 2025, then funneled the stolen ETH through THORChain like it was built for them. Over five days, $2.91 billion in volume ripped through the chain.

— Yogi (@HouseofYogiX) March 4, 2025

According to blockchain analytics firm Nansen, the hackers started interacting with third-party services from the second hop in their transaction chain.

These services were used to swap and launder the stolen funds.

“Entities with the most inflow volume from the hack include THORChain, Paraswap, Mantle, OK DEX and DODO,” Nansen stated. Among these services, THORChain received the highest volume.

Onchain analyst EmberCN reported that the hackers have now laundered all 499,000 ETH ($1.39 billion) stolen from Bybit.

This process took just 10 days to complete. The Ethereum price dropped by 23% during this period.

The value fell from $2,780 to $2,130 as the stolen funds were moved through the market.

Some critics feel that THORChain could have done more to prevent the movement of stolen funds.

“Other protocols have blocked dirty wallets without killing decentralization. THORChain had options—Elliptic, transaction monitoring—but ignored them,” crypto commentator Yogi added.

According to Elliptic, 11,084 cryptocurrency wallet addresses are suspected to be linked to the Bybit exploit. This list is expected to grow as investigations continue.

Meanwhile, Bybit CEO Ben Zhou confirmed that $280 million of the stolen funds had “gone dark.” This means the money has been laundered and is no longer traceable on public blockchains.