Bybit Hackers Launder Nearly $3 Billion Through THORChain

Please log in or register to do it.

Hackers from the North Korean Lazarus Group laundered nearly $3 billion in stolen funds from Bybit through THORChain, a decentralized cross-chain swap protocol. This activity generated significant trading volume, resulting in $3 million in fees for THORChain. In response, THORChain is working to enhance its monitoring and screening capabilities to prevent future misuse of the platform.

Earning the Protocol $3 Million in Fees

THORChain, a decentralized cross-chain swap protocol, experienced an unprecedented spike in activity after hackers responsible for the Bybit security breach laundered stolen funds through its platform.

How the Laundering Happened According to on-chain analyst Yu Jin, the North Korean Lazarus Group—a notorious state-backed hacking organization—used THORChain to convert stolen Ethereum (ETH) into Bitcoin (BTC). This laundering process generated approximately $2.91 billion in trading volume for THORChain and earned the protocol around $3 million in transaction fees.

Record-Breaking Trading Volume

Before this event, THORChain's average daily transaction volume was roughly $80 million. However, starting on February 22, that figure soared to $580 million per day. In just five days, the protocol processed $2.91 billion in total swaps.

The activity peaked on February 26, when THORChain processed a record-breaking $859.61 million in daily volume—the highest in its history. The following day, February 27, the platform saw another $210 million in swaps, pushing the 48-hour total past $1 billion, according to data from THORChain Explorer.

Lazarus Group's Laundering Tactics

Swapping stolen assets into Bitcoin is a well-documented tactic used by the Lazarus Group to obscure the origin of illicit funds. By leveraging decentralized platforms like THORChain—which offer non-custodial cross-chain swaps—they can sidestep traditional financial oversight and launder funds more efficiently.

THORChain Responds :

A core developer of THORChain, known as Pluto, who also serves as an engineer at Nine Realms, acknowledged that illicit funds had flowed through the protocol. Pluto stated that the team is actively working with wallet providers and integration partners to introduce screening services designed to help identify and prevent future misuse of the platform.

Key Takeaways

-$2.91 billion in illicit funds flowed through THORChain in just five days.

-THORChain earned $3 million in fees from these transactions.

-The incident highlights the growing use of decentralized protocols for laundering stolen crypto assets.

-THORChain is now taking steps to enhance monitoring and screening capabilities to address this risk.

Reactions

alexisread