THORChain: $5M in Fees as Lazarus Group Launders $5.4B

THORChain, a decentralized cross-chain asset swap protocol, has generated over $5 million in fees and processed more than $5.4 billion in volume since the Bybit hack in February. The surge in activity was driven by the North Korean state-affiliated Lazarus Group, which exploited the centralized crypto exchange Bybit for over $1.4 billion worth of crypto.

The Lazarus Group continued to launder the stolen funds, using THORChain for a significant part of these transfers. According to data from the THORChain explorer, the protocol processed over $5.4 billion in total swap volume, generating approximately $5.5 million in revenue since the exploit.

THORChain's swap volume exceeded $1 billion in a single day following the Bybit hack, with the protocol generating over $554,000 in total income that day alone. However, the protocol has faced criticism for its role in facilitating the movement of illicit funds.

On Feb. 28, a THORChain developer quit the protocol after a vote to block North Korean hacker-linked illicit funds was reverted. The developer, known only as "Pluto," stated that they would no longer be contributing to THORChain.

Popular crypto commentator Yogi criticized THORChain for allowing stolen funds to flow through its platform, stating that the protocol had options to block dirty wallets without killing decentralization but ignored them.

On Feb. 26, blockchain analytics firm Elliptic flagged 11,084 cryptocurrency wallet addresses suspected of being linked to the Bybit exploit. Bybit CEO Ben Zhou confirmed on March 4 that $280 million of the stolen funds had gone dark, meaning that it has been laundered and is no longer traceable.