THORChain’s Daily Revenue Jumped While Being Connected To Bybit Hack Perpetrators

Bybit’s hack was lauded as one of the most blatant and biggest hacks ever. A lot happened surrounding the hack. A North Korean state-sponsored hacking group known as the Lazarus Group has been found guilty of the crime, but there have been no arrests as of yet. However, the investigative committee found one small clue that points to THORChain. 

THORChain is a cross-chain swap protocol used by the hacker(s) to launder stolen funds. As per the on-chain investigator, Yu Jin, the Lazarus Group used THORChain to turn their stolen ETH into BTC. This generated a total trading volume of $2.91 billion. Sources suggest that the group also earned nearly $3 million in fees.  

THORChain Before The Heist 

Before the heist, the exchange’s daily average transaction volume was around $80 million. However, from February 22nd, this figure has jumped close to  $580 million per day. On February 26th alone, the exchange processed $859.61 million in swaps. Sources suggest that this is the highest the company has ever earned in one day. As of now, the firm has managed to earn close to $3.91 billion from February 22nd to February 27th.  

Swapping coins is a known tactic used by the Lazarus Group. This is done to muddle the money trail and throw off regulatory bodies. This time, the group decided to pick THORChain for its illicit money laundering. However, the real question is why. Why did the Lazarus group pick THORChain? Subsequently, what was the cause behind the convenient increase of the company‘s daily volume in earnings after the heist?  

However, THORChain core developer, Pluto, issued a statement at the wake of these events. Pluto stated, “When we first started seeing illicit flows on THORChain, our team bridged the gap for wallets and integration partners, helping them integrate screening services like @elliptic.”  

When we first started seeing illicit flows on THORChain, our team bridged the gap for wallets and integration partners, helping them integrate screening services like @elliptic. I am pleased to that @SwapKitPowered and @RangoExchange offer this solution to their partners. Any… https://t.co/3yHifg925m

— Pluto (9R) (@Pluto9r) February 22, 2025