THORChain generated $3.01 million in system income in September, its highest monthly total since March 2025, with roughly $1.9 million — about 63% of the month's income — earned in the five days after the Bitget hack, according to the protocol's own monthly network report.

The cross-chain exchange recorded $2.40 billion in swap volume during September, the most since June 2025. Activity concentrated sharply around the exploit: about $1.37 billion, or 57% of monthly volume, crossed the network between Sept. 25 and Sept. 29.

THORChain attributed the spike directly to stolen funds moving through the protocol. In its State of the Network report, the protocol said: "Between September 25 and 29, daily volume ran between roughly $190M and $460M as funds linked to the Bitget exploit moved through the network."

Bitget said roughly $387.5 million was transferred to attacker-controlled addresses during the September breach. THORChain does not break out how much of its fee income came specifically from stolen-fund swaps; period totals cover all activity.

Why did THORChain not block the stolen funds?

The revenue concentration highlights the economic consequences of a stance THORChain defended publicly after the hack. The protocol rejected calls for selective intervention, arguing on X that it is decentralized and permissionless in the same way as Bitcoin, Ethereum and BNB Chain.

It also drew a technical distinction between two mechanisms. A network halt is an emergency measure designed to protect THORChain itself. Censoring individual addresses or transactions, the protocol argued, is a different category of action it will not take.

THORChain pointed to precedent from its own May exploit, when attackers stole $10.7 million from its liquidity pools but were not subsequently blacklisted from swapping assets through the network.

Did the surge reflect real user growth?

Wallet data suggests no. Active wallets rose to 25,000 in September from 23,500 in August, and new wallets edged up to 22,400 from 21,800. THORChain said wallet activity barely responded to the late-month volume spike, indicating concentrated transactions from a relatively small number of participants.

The baseline growth complicates the headline improvement in protocol economics:

• September income reached $3.01 million, almost five times August's $615,000.
• Swap volume nearly quadrupled from $613 million to $2.40 billion.
• Most of the incremental activity landed in the same five-day window as the hack-linked flows.
• RUNE's seven-day annualized return hit 69.03% on Sept. 29; TCY's reached 29.74%.

THORChain expects the trailing yield figures to decline as the high-fee days roll out of the calculation window.

Frontend affiliates separately earned about $840,700 in September, with roughly $669,000 going to unidentified affiliates.

What happens to THORChain's economics now?

For liquidity providers and token holders, the immediate question is whether ordinary trading can replace the exceptional activity that lifted September's returns. If volume normalizes toward pre-hack levels while wallet growth remains modest, income and trailing yields could retreat sharply.

A durable improvement would require THORChain to convert September's visibility into recurring flow from traders and integrators rather than depend on episodic bursts driven by unusually large transactions — a test that will play out in the protocol's October network data.