Skip to content
- THORChain saw a surge in trading volume, surpassing $1 billion within 48 hours after Bybit’s hack.
- North Korea’s Lazarus Group has used THORChain to launder stolen funds by converting them into Bitcoin.
- THORChain’s token value rose by 20.66% over the past week as the protocol works with partners to curb illicit activity.
THORChain, a decentralized finance (DeFi) protocol for cross-chain swaps, has experienced a significant spike in activity following the recent $1.4 billion hack at Bybit. According to THORChain Explorer data, the platform processed a record-breaking $859.61 million in swaps on February 26. This momentum carried into February 27, with an additional $210 million in trading volume, pushing the total to over $1 billion within 48 hours.
Source: THORChain Explorer
THORChain allows users to directly exchange digital assets between different blockchains, like swapping Ether for Bitcoin. However, this functionality has also attracted malicious actors. Notably, North Korea’s Lazarus Group, a state-sponsored hacking group, has exploited this feature for illicit activities, using it to launder stolen funds.
Combating Fraud on THORChain
However, the developers of THORChain are already responding to such risks by investigating the problem of abuse of the platform for illicit purposes. Nine Realms engineer “Pluto” said that some of the stolen funds have likely transited through THORChain but denied any direct involvement in the theft and stated that the team is working on rectifying this. For more efficient handling of such fraudulent activities, the protocol is working in partnership with wallets and integration partners to incorporate screening services. This would prevent fraudulent activities from taking place.
Trading volume has risen while trading volume has also enhanced the value of THORChain token as well. As of press time, Rune is trading at $1.44 showing a 20.66% increase over the past week. This increase in value can be attributed to the growing use of THORChain in cross-chain swaps even as it was accused of being involved in fraudulent activities.
Source: Tradingview
Bybit Tracks Stolen Funds
In response to the hack, Bybit created a tracking website of wallets containing the stolen funds and also put a bounty on the heads of people that will assist in freezing the stolen money. By February 27, the site reported such exchanges that managed to freeze the stolen Bitcoin as two popular exchanges – Poloniex and Bittrex – and several lesser-known platforms, as well as one rather questionable actor, eXch.
The No-KYC service has been accused of failing to freeze the funds associated with the Bybit hack. eXch has also dismissed any involvement in money laundering for the Lazarus group.
Source: LazarusBounty
The hack on Bybit was on the 21st of February, with ZachXBT, the blockchain investigator, and the FBI attributing it to the Lazarus group. It has also emerged that the attackers easily obtained SafeWallet’s account details with which they executed the heist.
According to reports from Sygnia and Verichains, the attack came from the injection of JavaScript into SafeWallet’s AWS environment. In response to this, the developers of the SafeWallet application have sought to modify its security systems and framework to avoid such penetrations in the future.
