Thorchain DEX Laundering Analysis

Across 7 confirmed laundering incidents from 2023 to 2026, THORChain processed approximately $9.27 billion in inorganic volume — representing roughly 8.3% of its total all-time DEX volume. More damning: THORChain's 0.1% swap fee means the protocol and its liquidity providers earned an estimated ~$12.47M in fees directly from these illicit flows. The Bybit/Lazarus Group incident alone — where North Korean state hackers laundered $1.5B stolen from Bybit — generated $8.63M in fees in just 10 days, setting THORChain's all-time single-day volume record at $1.07 billion on March 2, 2025.

The protocol's response was deeply revealing: a community vote to block Lazarus transactions failed, the chief developer resigned in protest, and founder John-Paul Thorbjornsen defended the protocol by arguing "no sanctioned wallet has interacted with it." Chainflip — a competitor — blocked the hackers. THORChain did not.

THORChain distinguishes between total fees (all swap fees collected, ~0.1% of volume) and protocol revenue (the subset routed to the network reserve vs liquidity providers). The laundering share diverges significantly:

The difference reveals that laundering events had a disproportionate impact on fee income for liquidity providers (the spread between fees and revenue). During the Bybit/Lazarus incident, the protocol earned over $8.6M in fees in 10 days — equivalent to ~25% of its 2024 full-year fee income — but the revenue split meant LPs captured the lion's share.

Worst of all: 2026 is tracking toward 31% laundering share of both fees and revenue in just the first 4 months. The problem is accelerating, not receding.

When hackers route billions through THORChain, swap fees flow to liquidity providers and the protocol — driving short-term RUNE demand. This created a deeply cynical pattern: RUNE pumped during most laundering events while victims lost everything.

The FTX hacker is the one outlier where RUNE fell — perhaps because the market was still digesting the broader FTX collapse. In every subsequent incident, RUNE rose as hackers pumped volume. RUNE holders were, in effect, indirect beneficiaries of stolen funds.

THORChain's defenders argue it is neutral infrastructure — like TCP/IP, it doesn't discriminate between users. There is philosophical merit to this view. But the evidence paints a more damning picture: when given the chance to act, the community voted to do nothing. Chainflip proved that blocking is technically possible. The developer who led the protocol resigned because it wouldn't act. The FBI issued a public notice. And THORChain kept processing.

The result is a protocol that:

• Earned ~$12.5M in fees from confirmed laundering — approximately 10.4% of lifetime protocol fees
• Earned ~$4.9M in protocol revenue from laundering — approximately 5.7% of lifetime revenue
• Saw its RUNE token pump during most hacking incidents, meaning token holders financially benefited
• Lost organic competitive ground to Uniswap, PancakeSwap, and other DEXes
• Has a RUNE token now trading ~97% below its 2021 all-time high

THORChain's architecture — native-to-native swaps with no KYC, no custodian, no freeze mechanism — makes it uniquely valuable to bad actors. Until governance changes course, it will continue to be the first call for any hacker needing to convert ETH to BTC at scale. The protocol's epitaph may well read: built to be unstoppable, and that was the problem.