thorchain

According to on-chain investigator vxdb, the cryptocurrency exchange platform Gamdom is suspected to have been hacked, involving a total asset value of approximately 4.208 million USD.In terms of losses by chain, EVM networks such as Ethereum, BNB Chain, Polygon, Arbitrum, and Optimism account for about 2.2 million USD, Solana approximately 965,000 USD, TRON around 375,000 USD, and Bitcoin about 668,000 USD.On-chain tracking shows that some of the stolen funds have been transferred to platforms such as Hyperliquid and THORChain through cross-chain bridges and token exchanges.

The cross-chain exchange protocol THORChain officially announced that its native token RUNE has been 100% unlocked. The official statement indicated that the supply of RUNE has been continuously decreasing, starting with 1 billion tokens, which later dropped to 500 million. In May, based on ADR-023, 64.4 million RUNE were destroyed from reserves, further reducing the supply to 360 million.The official also introduced the system's revenue distribution. Nodes must bind RUNE to ensure the security of THORChain and receive 59% of the system's revenue, which comes from the fees paid by users during cross-chain exchanges. An additional 20% flows into the protocol's own liquidity, and every 3 days, the protocol deposits RUNE into the liquidity pool with the highest relative depth of fees, half of which is retained in the form of RUNE and held by THORChain.

According to The Defiant, the stablecoin issuer Tether has blacklisted four THORChain treasury addresses, which collectively hold approximately 1.45 million USDT.As a result, THORChain's Tron cross-chain exchanges and liquidity provider-related operations have been suspended. THORChain co-founder Chad Barraford stated that the team did not receive any prior notice before Tether took action.

Decentralized exchange THORChain announced that native Zcash swaps are now live, allowing users to exchange ZEC with assets on other supported blockchains without relying on wrapped tokens or centralized exchanges. This launch follows the protocol's 3.20 update, which introduced support for Zcash and Monero. At that time, the liquidity in the Zcash pool exceeded $50,000, and the network has begun processing real ZEC swaps.The pool is currently in a soft launch phase, with performance being monitored. If vulnerabilities or other issues arise, trading may be temporarily paused. The current pool size can easily support five-figure trades, while larger trades will experience higher slippage and slower settlement until liquidity increases. When the fee-to-depth ratio is sufficiently high, the protocol's own liquidity will automatically join the Zcash pool. This mechanism was introduced with the 3.20 upgrade, allowing the protocol to deploy a portion of liquidity fees (initially set at 20%) to supported liquidity pools.After integration, ZEC holders can swap their native assets with supported assets such as Bitcoin, Ethereum, and stablecoins without needing to deposit Zcash with a centralized custodian or convert it into wrapped assets on other networks. Zcash brings the total number of native blockchains in THORChain's cross-chain liquidity network to 14, with swaps settled in native assets on their respective chains, rather than transferring assets through cross-chain bridges or requiring users to relinquish custody.

THORChain announced that the ZEC liquidity pool is now live, and the network has completed a node rotation, with all nodes beginning to monitor the Zcash chain.THORChain stated that trading functionality will be the next step; currently, liquidity is shallow, and early traders should be aware of risks such as slippage. Previously, THORChain added native support for Zcash in the protocol upgrade, including UTXO handling, RPC logic, and ZEC price oracles, and continues to advance mainnet integration.

The cross-chain liquidity protocol ThorChain's official announcement states that the network interruption is an emergency security mechanism aimed at protecting the protocol's security. The suspension is not a selective freeze of specific funds, nor is it a targeted exchange against individuals.The announcement mentioned that in the security incident in May 2026, 10.7 million dollars were stolen from the liquidity pool. At that time, the attacker's address was not blacklisted, so it could still trade on ThorChain. ThorChain stated that it is a permissionless blockchain platform designed with the intention of not conducting any censorship.

GoPlus Security posted on platform X that the outflow of funds from THORChain needs to be actively signed by validators through TSS threshold signatures, which is different from Bitcoin and Ethereum; approximately 101.5 BTC (about 8.5 million USD) has already been transferred from the stolen funds on Bitget, and about 27.63 million XRP (about 43 million USD) is being exchanged for BTC, calling for interception of North Korea-related addresses.

According to Blockworks data, the cross-chain liquidity protocol THORChain achieved approximately $381,700 in revenue on September 25, setting a new high since April 25.The day's exchange trading volume reached $211 million, marking the second highest since April 23, only behind approximately $280 million on September 10.

According to on-chain analyst Yu Jin's monitoring, over 90% of the funds exchanged across chains through THORChain are from illicit sources. Yu Jin stated that most of the stolen funds from Bybit last year were transferred via THORChain, which collected nearly 10 million dollars in fees within 10 days; recently, part of the stolen funds from Bitget has also been transferred through THORChain, with its fee income reaching 1 million dollars.

OKX founder Star Xu posted on X to refute that the cross-chain liquidity protocol THORChain has actually proven itself to not be truly decentralized. He stated that in May, when THORChain's own treasury was drained, the node operators paused the entire network within minutes, causing it to go offline for 13 hours.Star Xu also claimed that a network that can stop when its own funds are at risk, but refuses to stop when others' funds are at risk, does not "act like Bitcoin." He pointed out that Bitcoin cannot be stopped, while THORChain can be stopped; it simply chooses when to stop.

Slow Fog's Yuxian stated on platform X that the Bitget theft incident has a wide spread, involves a huge amount of money, and the related funds were quickly linked to North Korean hackers. Institutions such as Circle and Tether have promptly assisted in freezing the related funds, with Circle freezing the USDC held by the hackers.Regarding THORChain, Yuxian pointed out that when THORChain previously experienced a theft incident, it also quickly intervened in its so-called "decentralized" platform; however, in response to this major security incident in the industry, it claimed "decentralization and non-interference" and compared itself to Bitcoin and Ethereum, while continuing to earn fees from the hackers' large cross-chain transactions.He stated that decentralization should not just be a slogan; after a major security incident occurs, the key is to distinguish which issues need to be collectively addressed by the industry. He also believes that platforms like THORChain should not be easily compared to Bitcoin and Ethereum, as there are significant differences in the degree of decentralization and mechanisms of different systems.

MistTrack disclosed that following the $1.46 billion hacking incident at Bybit last year, where nearly $1.2 billion in stolen funds were transferred via THORChain, Bitget has recently experienced another significant security incident, with stolen funds suspected to have once again flowed through THORChain.In response, THORChain officials stated that their protocol, like Bitcoin, Ethereum, and BNB Chain, belongs to a decentralized and permissionless network.

Bitget CEO stated that the attacker's address has been publicly listed and is under continuous tracking. Bitget calls on THORChain to refuse service to these addresses. Decentralization is a design principle and should not serve as a shield to facilitate known stolen funds.

According to on-chain analyst Yu Jin's monitoring, a certain whale has completed a cross-chain purchase of BTC. Over the past 4 days, this whale has spent 85.42 million USDC to buy 1075.6 BTC, with an average cost of 79,412 dollars, which includes approximately 170,000 dollars in exchange fees paid to THORChain.

According to on-chain analyst Yu Jin's monitoring, a certain whale continues to cross-chain buy 544.5 BTC, worth 42.43 million USD.In the past two days, this whale has exchanged 60.37 million USDC for 767.8 BTC through THORChain, with an average price of approximately 78,628 USD.

According to EmberCN monitoring, a whale that cleared 50,600 ETH at an average price of $2,921 last year, realizing a profit of about $19.02 million, has started buying BTC again after being silent for about 8 months.In the past day, this whale has exchanged 14.2 million USDC for 179.8 BTC through THORChain, with an average purchase price of about $78,955. Currently, this whale continues to buy and still holds about 74.32 million USDC.

According to Bitcoin News monitoring, Coldcard thieves are prioritizing the emptying of the largest portion of the third wave vaults. Galaxy Research indicates that these wallets have transferred out 97.09 BTC, worth approximately 7.7 million dollars, accounting for about 45% of the assets in this batch.The attackers created 293 2/2 vaults themselves, and had transferred some tokens through THORChain on September 2, subsequently moving them into multiple rounds of CoinJoin over the weekend. The vulnerability originated from a firmware flaw in 2021, which reduced the seed entropy to a minimum of 40 bits. Of the tokens stolen in this exploit, approximately 82% have not yet been transferred.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.