thorchain

The cross-chain liquidity protocol ThorChain's official announcement states that the network interruption is an emergency security mechanism aimed at protecting the protocol's security. The suspension is not a selective freeze of specific funds, nor is it a targeted exchange against individuals.The announcement mentioned that in the security incident in May 2026, 10.7 million dollars were stolen from the liquidity pool. At that time, the attacker's address was not blacklisted, so it could still trade on ThorChain. ThorChain stated that it is a permissionless blockchain platform designed with the intention of not conducting any censorship.

GoPlus Security posted on platform X that the outflow of funds from THORChain needs to be actively signed by validators through TSS threshold signatures, which is different from Bitcoin and Ethereum; approximately 101.5 BTC (about 8.5 million USD) has already been transferred from the stolen funds on Bitget, and about 27.63 million XRP (about 43 million USD) is being exchanged for BTC, calling for interception of North Korea-related addresses.

According to Blockworks data, the cross-chain liquidity protocol THORChain achieved approximately $381,700 in revenue on September 25, setting a new high since April 25.The day's exchange trading volume reached $211 million, marking the second highest since April 23, only behind approximately $280 million on September 10.

According to on-chain analyst Yu Jin's monitoring, over 90% of the funds exchanged across chains through THORChain are from illicit sources. Yu Jin stated that most of the stolen funds from Bybit last year were transferred via THORChain, which collected nearly 10 million dollars in fees within 10 days; recently, part of the stolen funds from Bitget has also been transferred through THORChain, with its fee income reaching 1 million dollars.

OKX founder Star Xu posted on X to refute that the cross-chain liquidity protocol THORChain has actually proven itself to not be truly decentralized. He stated that in May, when THORChain's own treasury was drained, the node operators paused the entire network within minutes, causing it to go offline for 13 hours.Star Xu also claimed that a network that can stop when its own funds are at risk, but refuses to stop when others' funds are at risk, does not "act like Bitcoin." He pointed out that Bitcoin cannot be stopped, while THORChain can be stopped; it simply chooses when to stop.

Slow Fog's Yuxian stated on platform X that the Bitget theft incident has a wide spread, involves a huge amount of money, and the related funds were quickly linked to North Korean hackers. Institutions such as Circle and Tether have promptly assisted in freezing the related funds, with Circle freezing the USDC held by the hackers.Regarding THORChain, Yuxian pointed out that when THORChain previously experienced a theft incident, it also quickly intervened in its so-called "decentralized" platform; however, in response to this major security incident in the industry, it claimed "decentralization and non-interference" and compared itself to Bitcoin and Ethereum, while continuing to earn fees from the hackers' large cross-chain transactions.He stated that decentralization should not just be a slogan; after a major security incident occurs, the key is to distinguish which issues need to be collectively addressed by the industry. He also believes that platforms like THORChain should not be easily compared to Bitcoin and Ethereum, as there are significant differences in the degree of decentralization and mechanisms of different systems.

MistTrack (@MistTrack_io) disclosed that following the nearly $1.2 billion stolen funds from last year's Bybit $1.46 billion hacking incident being transferred via THORChain, Bitget has recently experienced another significant security incident, with stolen funds suspected to have again flowed through THORChain. In response, THORChain officials stated that their protocol, like Bitcoin, Ethereum, and BNB Chain, belongs to a decentralized, permissionless network.

Bitget CEO posted that the attacker's address has been publicly listed and is being continuously tracked. Bitget officially requests THORChain to refuse service to these addresses. Decentralization is a design principle and should not serve as a shield to facilitate known stolen funds.

According to on-chain analyst Yu Jin's monitoring, a certain whale has completed a cross-chain purchase of BTC. Over the past 4 days, this whale has spent 85.42 million USDC to buy 1075.6 BTC, with an average cost of 79,412 dollars, which includes approximately 170,000 dollars in exchange fees paid to THORChain.

According to on-chain analyst Yu Jin's monitoring, a certain whale continues to cross-chain buy 544.5 BTC, worth 42.43 million USD.In the past two days, this whale has exchanged 60.37 million USDC for 767.8 BTC through THORChain, with an average price of approximately 78,628 USD.

According to EmberCN monitoring, a whale that cleared 50,600 ETH at an average price of $2,921 last year, realizing a profit of about $19.02 million, has started buying BTC again after being silent for about 8 months.In the past day, this whale has exchanged 14.2 million USDC for 179.8 BTC through THORChain, with an average purchase price of about $78,955. Currently, this whale continues to buy and still holds about 74.32 million USDC.

According to Bitcoin News monitoring, Coldcard thieves are prioritizing the emptying of the largest portion of the third wave vaults. Galaxy Research indicates that these wallets have transferred out 97.09 BTC, worth approximately 7.7 million dollars, accounting for about 45% of the assets in this batch.The attackers created 293 2/2 vaults themselves, and had transferred some tokens through THORChain on September 2, subsequently moving them into multiple rounds of CoinJoin over the weekend. The vulnerability originated from a firmware flaw in 2021, which reduced the seed entropy to a minimum of 40 bits. Of the tokens stolen in this exploit, approximately 82% have not yet been transferred.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

According to Decrypt, THORChain announced the launch of version 3.2, which adds native cross-chain exchange support for Monero (XMR) and Zcash (ZEC). Users can directly exchange XMR and ZEC for BTC, ETH, and stablecoins without the need to wrap assets, register centralized exchange accounts, or relinquish asset custody.This upgrade also introduces Protocol Owned Liquidity (POL) and Stable Reserve, and restores support for Solana, Base, and BNB. Among them, Stable Reserve supports zero liquidity fee exchanges between stablecoins. This upgrade is expected to provide a new non-custodial trading path for users facing liquidity channel shrinkage due to centralized exchanges delisting or restricting XMR.

CertiK stated that its monitoring system detected two transactions of 200 ETH each being transferred to Tornado Cash, and the related funds are associated with the ongoing Coldcard Wallet attack incident.The aforementioned funds were previously transferred from BTC to an Ethereum address via THORChain, and then subsequently transferred to Tornado Cash.

According to on-chain analyst Yu Jin's monitoring, the AFX Trade hacker has begun exchanging ETH for BTC through the cross-chain exchange tool THORChain. The bridge of AFX Trade was hacked two days ago, resulting in the theft of 24.15 million USDC, which were subsequently exchanged for 12,500 ETH.One hour ago, the hacker started exchanging ETH for BTC across THORChain, and so far, 655.4 ETH have been exchanged for 18.86 BTC.

According to the THORChain announcement, the network has fully resumed operation after being offline for more than a month, with core functions such as signing, node churning, asset custody, liquidity provision, and cross-chain exchanges back online, and trading services officially restored.THORChain stated that this recovery prioritizes security and stability, and comprehensive verification of the treasury and key shares has been completed. The future roadmap includes native Monero exchanges, Zcash support, dynamic fees, and deeper liquidity optimization.