Bitcoin sees inflows as ETH from Bybit hack via THORChain

What happened: Bybit hack funds swapped ETH to BTC via THORChain

According to CryptoSlate, Bybit CEO Ben Zhou said roughly $1.07 billion of stolen assets remain trackable despite the attackers converting about 83% of the ETH haul to BTC across 6,954 wallets. The figures also indicate a long-tail dispersion pattern, suggesting deliberate fragmentation to complicate exchange screening and risk controls.

As reported by Cointeeth, about 72% of the ETH that was converted ultimately routed through THORChain, making it the dominant bridge for native-to-native swaps into Bitcoin. The scale of this single-protocol concentration has shaped the subsequent traceability debate and governance responses.

Why THORChain routing matters for traceability and protocol responsibility

THORChain is designed for native cross-chain swaps via liquidity pools coordinated by validators, not custodial wrappers, which preserves on-chain auditability but adds cross-ledger complexity. Investigators can trace flows, yet hop density, wallet fan-out, and timing across chains raise the cost and time required to reconcile provenance.

According to Followin.io, Pluto, a core THORChain developer, acknowledged screening limits, noting many hacker addresses were not on sanctions lists such as OFAC at the time they interacted with the protocol. That timing gap reduces the effectiveness of automated blocks and blacklists at the validator or interface layer.

As reported by Forklog, Pluto subsequently stepped down amid pressure for stronger action, underscoring the tension between decentralization and expectations of protocol-level controls. The incident has pushed governance into evaluating what interventions, if any, are compatible with THORChain’s design and legal posture.

“Calling this ‘laundering’ is technically misleading, it’s conversion, and the swaps remain traceable, even if cross-chain pathways are being weaponized,” said Federico Paesano, Investigations Lead at Crystal Intelligence.

A substantial majority of the stolen assets remain on-chain identifiable, while a smaller portion has been frozen and a minority has gone “dark” after mixing and dispersion. Recovery paths, if any, would depend on continued coordination with exchanges and law enforcement thresholds for seizures.

According to Arkham Intelligence, more than $240 million in stolen ETH was tracked through wallets linked to the Lazarus Group using THORChain. These findings indicate that, despite routing complexity, wallet clustering and attribution heuristics still yield actionable leads.

As reported by CryptoNewsLand, additional routes included decentralized exchanges such as Uniswap and Paraswap, alongside proxy tooling like OKX Web3, further diversifying the conversion pathways. Multi-route strategies increase operational friction for investigators but do not negate traceability.

“At this stage, a large share remains traceable despite mixing via thorchain and other routes,” said Ben Zhou, CEO at Bybit.

At the time of this writing, THORChain’s RUNE traded near $0.4139, with very high 15.44% volatility and bearish sentiment. These market metrics are contextual and do not imply causation or investment guidance.

FAQ about Bybit hack

How did the hackers convert ETH to BTC using THORChain and other cross-chain routes?

They executed native-to-native swaps on THORChain, splitting flows across many wallets to reduce detection risk. Additional hops through decentralized exchanges and proxy tooling diversified the trail.

How much of the stolen funds are still traceable or frozen, and can they be recovered?

Bybit’s CEO has said most funds remain traceable, a small share is frozen, and a minority is untraceable. Any recovery is uncertain and dependent on ongoing coordination.

At the time of writing, THORChain’s RUNE traded near $0.4139; figures are contextual and not investment guidance.

Figures cited come from named institutions and executives; where unknowns remain, conditional wording reflects investigative uncertainty.