Key Highlights:
- THORChain swap fees and revenue dropped 82% below the highs recorded during late September, when illicit flows linked to the Bitget security breach artificially drove up volume.
- Capital movements from the Bitget exploit accounted for approximately 57% to 63% of THORChain’s total September trading volume and protocol income.
- The network increased its active validator node count to 103 and adjusted its economic parameters, lowering the $RUNE burn allocation to 1% while steering 20% toward Protocol-Owned Liquidity.
THORChain Network Activity Moderates Following Surge in Exploit-Linked Volume
Cross-chain liquidity protocol THORChain has recorded a notable normalization in fee collection, with recent weekly swap revenue falling 82% below the peaks recorded during late September. Data compiled from DeFiLlama reveals that the spike occurred between September 25 and October 1, generating approximately $2.28 million in protocol fees during what became known as the exploit week. Following that surge, fees recorded between October 2 and October 8 plummeted by 90%, with the subsequent seven-day period sustaining an 82% decline relative to that historical ceiling.
Over the most recent seven-day window, Ethereum captured the largest share of swap fees across the protocol at $129,183. THORChainās native chain represented the second-largest contribution with $95,516, followed by Bitcoin at $74,517 and Tron at $64,747. Notably, the protocol experienced no major exploits or abnormal spikes during the month of October.
The Bitget Breach and Network Income Metrics
A substantial portion of THORChainās late-September activity was tied to capital movements originating from an attack on cryptocurrency exchange Bitget. Bitget suffered a major breach on September 24 that resulted in an estimated loss of $387.5 millionāan upward revision from an initial assessment of $351.6 million once additional outflows involving Zcash and TRON were accounted for.
Between September 25 and September 29, transactions tied to the Bitget incident accounted for roughly 57% to 63% of THORChainās monthly operational metrics. This single window generated around $1.37 billion in swap volume and nearly $1.9 million in protocol income. Consequently, overall September metrics saw swap volume soar to $2.40 billion from $613 million in August, while total monthly network income expanded to $3.01 million compared to $615,000 the preceding month.
Governance Stance on Asset Freezes and Structural Updates
In the aftermath of the incident, Bitget CEO Gracy Chen issued a public appeal on September 26 requesting that THORChain restrict service to wallet addresses associated with the attacker. Centralized stablecoin issuers Circle and Tether had previously acted on September 25 to freeze approximately $318,000 in assets associated with the stolen funds. THORChain, however, declined to blacklist the addresses, explaining that its emergency halt functionality exists strictly as a whole-system defensive safeguard rather than a targeted address-freezing mechanism. The protocol emphasized that it operates without admin keys or a controlling multisig setup, pointing out that it maintained the same stance following an earlier $10.7 million vault exploit in 2026.
Parallel to transactional volatility, the protocol registered organic user growth and implemented adjustments to its tokenomics. Active user wallets expanded to 25,000 in September, rising from 23,500 in August. THORChain’s State of the Network report confirmed that the active validator set increased from 87 to 103 nodes. Furthermore, the network restructured its revenue model: the system reduced the $RUNE burn allocation from 5% down to 1%, redirecting 20% of system income into Protocol-Owned Liquidity (POL), which held roughly 946,000 $RUNE in cumulative deposits by the end of September.
Why This Matters
The divergence between THORChain’s decentralized design and the compliance expectations of centralized exchanges highlights an ongoing structural friction across the broader crypto ecosystem. Because THORChain relies on an automated network of independent nodes without administrative override privileges, it functions permissionlessly even when processing addresses flagged by third-party exchanges. At the same time, the steep 82% drop in swap revenues reinforces how temporary external shocksāsuch as exchange breachesācan distort underlying decentralized finance (DeFi) revenue figures. THORChain’s strategic pivot toward building Protocol-Owned Liquidity indicates a concerted effort to anchor long-term network-owned capital independent of short-term volume fluctuations.
Frequently Asked Questions
Why did THORChain’s swap revenue fall by 82%?
The steep decline reflects a return to normal operational levels following an unprecedented volume spike between September 25 and October 1. That prior period saw an influx of an estimated $1.37 billion in swaps and roughly $1.9 million in fees resulting from funds moved after the Bitget hack.
Why did THORChain refuse to freeze the Bitget hacker’s funds?
THORChain operates on a decentralized architecture without central administration keys or a multisig controller capable of blacklisting specific user wallets. The protocol stated that its emergency pause function is designed exclusively to protect the entire network from structural failures, not to intercept individual transactions or target specific addresses.
What changes did THORChain make to its economic model in September?
The protocol reduced the percentage of system income allocated to burning $RUNE from 5% to 1%. Concurrently, it reallocated 20% of system income toward Protocol-Owned Liquidity (POL), which held approximately 946,000 $RUNE in deposits by September.
