THORChain’s $500M Surge Exposes the Thin Line Between Privacy and Exploitation

THORChain posted its best single day of revenue in five months on September 25.

By September 27, its daily trading volume had ballooned past nearly $500 million, and the reason had nothing to do with organic growth, it had everything to do with a $387.5 million exchange hack moving through its pools in real time.

I started tracking this story because the September 25 numbers looked like a genuine recovery milestone for a protocol that spent part of this year rebuilding after its own security incident. What I didn’t expect was for that recovery narrative to collide, within 48 hours, with one of the sharpest public exchanges I’ve seen between a centralized exchange CEO and a decentralized protocol’s own account.

A Genuine Five-Month High, Before Everything Changed

On September 25, THORChain generated approximately $382,000 in revenue, according to data compiled by Blockworks, the highest single-day figure the protocol had posted since April 25. Trading volume that same day hit $211 million, the second-highest since April 23, trailing only the roughly $280 million recorded on September 10.

Taken on its own, that’s a solid, unremarkable growth story for a cross-chain protocol clawing back activity after a rough stretch. It’s the kind of number that would normally sit quietly in a daily market report.

None of this requires taking any outlet’s word for it. Blockworks maintains a continuously updated analytics dashboard for THORChain that tracks network revenue, swap volume, active bonded value, and pool liquidity directly from on-chain data.

Volume Nearly Octupled In A Single Day

What happened next is why this stopped being a routine growth story. On September 26, THORChain’s swap volume surged to approximately $1.72 billion, up dramatically from roughly $610 million for the entire month of August, and multiples above its own September 25 figure.

Fees jumped alongside it, climbing to about $2.2 million that day compared to $660,000 for all of August combined. And the surge didn’t stop there: by September 27, THORChain’s 24-hour DEX volume share had climbed a further 134.4% to roughly $508.4 million, according to DeFiLlama-tracked data, making it one of the fastest-growing venues in the entire decentralized exchange market that day.

This wasn’t organic trading demand. It was the direct result of stolen funds from Bitget’s $387.5 million hot wallet breach being routed through THORChain’s cross-chain pools as the attacker worked to convert and launder the proceeds.

Bitget Wants The Funds Blocked

Two days after the hack, Bitget CEO Gracy Chen took the dispute public on X. “Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses,” she wrote, framing the stakes bluntly: “Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching.” Chen’s request wasn’t the first time THORChain had faced this exact ask, the protocol was reportedly used to move somewhere between $1.2 and $1.5 billion of the funds stolen in the Bybit hack back in February 2025, making this feel less like a new demand and more like a second attempt at an old one.

THORChain’s Answer Turns The Question Around

THORChain’s official account responded the same day, and it didn’t concede ground. “We are devastated to hear about the recent exploit and can imagine how difficult this must be for everyone involved,” the protocol wrote, before pivoting into its actual position: “THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?” It’s a sharp rhetorical move, rather than defending its specific design choices, THORChain reframed Chen’s entire premise as a question that would apply equally to every permissionless base-layer network in crypto, Bitcoin included.

The Counterargument THORChain Doesn’t Address

Not everyone found that response convincing. Security firm GoPlus pushed back on the Bitcoin-and-Ethereum comparison specifically, pointing out that THORChain’s vaults are controlled by its validator set, which technically retains the ability to block or reverse transactions, unlike Bitcoin or Ethereum, where private keys sit entirely with users and no validator committee can intervene after the fact.

SlowMist’s founder, Yu Xian, made a related point publicly: that decentralization “is not a slogan” and shouldn’t be used to respond to industry security incidents with a blanket “no interference” stance. Both critiques land on the same idea, that THORChain’s governance structure isn’t quite as hands-off as the Bitcoin comparison implies, which makes its refusal a genuine policy choice rather than an unavoidable technical limitation.

A Strong Week Built On An Uncomfortable Source

That’s ultimately the tension sitting underneath this week’s numbers. THORChain’s revenue and volume charts show a protocol having its best stretch in five months, verifiable directly through Blockworks’ THORChain Analytics Dashboard. But a meaningful share of that surge is attributable to laundering activity from one of the year’s largest exchange hacks, and the protocol’s public response to being asked to intervene was to defend the same permissionless design that made it useful for that purpose in the first place.

Whether that’s a principled stance or a convenient one probably depends on which side of Chen’s original question you land on, but the volume charts don’t lie about where at least part of this week’s growth actually came from.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on X @nulltxnews