Investigation Says THORChain Routed $6.3 Billion in Stolen Funds
Key Facts
On-chain investigator ZachXBT said about $6.3 billion stolen from Binance and about $388 million from Bitget moved through THORChain and converged at the same address, a pattern that may point to a single attacker. RootData reported the figures from ZachXBT on October 30; the original post could not be verified directly. The flows have renewed attention on cross-chain swap protocols’ ability to move assets and on the limits their architecture places on requests to block specific addresses. Separately, Binance said the incident’s estimated total impact was about $6.3 billion. The exchange said it had worked with blockchain industry partners to freeze nearly $3 billion in affected assets on-chain as of October 30.
According to Bitquery analysis, funds were withdrawn from 17 Binance hot wallets across 9 networks between 20:04 and 23:56 UTC on October 29. Binance said its initial investigation indicated that an engineer’s laptop in DevOps had been compromised, enabling access to a service container and the submission of unauthorized withdrawal transactions. It added that it had found no evidence of a private wallet key leak. The exchange said it would cover losses from the SAFU fund and company funds, and that user funds were safe. These details place Binance’s account of the incident alongside the withdrawals documented by Bitquery’s analysis, without changing the exchange’s stated estimate of the total impact.
Bitquery said $2.7 billion was frozen or rescued, while $729 million in stablecoins was converted into ETH and TRX before freezes took effect. The analysis does not attribute all of those conversions to THORChain, nor does it establish that avoiding a freeze was their confirmed motive. According to Bitquery, the attacker still held about $3.2 billion at 06:43 UTC on October 30, mostly in ETH and BTC. Binance said it had frozen about $3 billion in on-chain assets in cooperation with industry partners. The reported figures reflect parallel paths for the funds: assets frozen or rescued, others converted before being frozen, and a balance still held by the attacker at the time cited in the investigation.
The dispute over how to handle attackers’ addresses dates to the September 24 Bitget hack, when the exchange lost about $387.5 million from its hot wallet infrastructure, according to THORChain’s third-quarter report. The report said some of the stolen funds were swapped through the network in the following days. On September 26, Bitget CEO Gracie Chen asked THORChain to refuse service to the attacker’s addresses, but the network rejected the request that same day. THORChain said it had no mechanism to block a specific swap, sender or recipient. This puts the protocol in the position of facing a request from an affected exchange to limit the movement of funds, while individual blocking decisions remain outside the mechanisms described in its report.
THORChain said node operators can halt a chain or the network when solvency is at risk, but a halt affects all users at the same time. The report said the network stopped for two days in late August after nodes disagreed over its state, attributing the incident to contracts in the Rujira application layer that produced different results across nodes. The halt shows that operators have a collective option to suspend activity, while the network says it has no mechanism to block a single address. In terms of usage, THORChain processed about $1.38 billion in trades between September 25 and 29, more than half of its total volume for September. This coincided with some of the funds stolen from Bitget moving through the network, according to its quarterly report.
At the network level, the third-quarter report said THORChain processed about $3.82 billion in trades and collected about $5.77 million in fees, with both figures close to double their second-quarter levels. The figures place September’s activity within a quarter that saw trading volume and fees rise, while the Bitget incident showed how network use was tied to flows that an affected exchange sought to stop. RUNE closed at $0.619 on October 29 and $0.672 on October 30, according to EL7 daily data. As for the network’s next step, its report said the v3.21 release was planned for October to address a decline linked to churn and issues in the application and signing layers.