THORChain Routed $46 Million of Stolen Binance Funds in 72 Hours

THORChain processed more than $46 million in funds stolen in the Binance hack during the first 72 hours after the attack. The cross-chain protocol generated more than $200,000 in fees over that same window, according to the estimate, which covers both the volume that moved through the protocol and the fees it produced.

The numbers put THORChain at the center of the laundering trail once again. The protocol, which lets users swap assets across different blockchains without a centralized intermediary, has become a recurring waypoint for attackers trying to convert stolen holdings into other assets.

What does this change for cross-chain infrastructure?

The practical question for regulators and protocol operators is straightforward. THORChain does not steal the funds. It processes whatever transactions users submit, and it charges fees for the service. That business model now has a documented revenue dimension tied to two of the largest crypto thefts on record.

The comparison with the Bybit incident is stark. During the 2025 Bybit theft, THORChain handled nearly $1 billion in stolen funds. Its operators earned at least $12 million in fees from that flow, according to the same reporting.

The Binance episode is smaller by an order of magnitude. But the pattern repeats. Attackers route funds through the protocol. Liquidity providers and node operators collect fees. Nobody along that chain stops to ask where the money came from.

The fee question nobody can dodge

THORChain co-founder John-Paul Thorbjornsen addressed the dynamic directly. Blockchain protocols generate fees through use, he said. That is the whole of the defense, and it is technically accurate. A permissionless protocol cannot screen counterparties the way a regulated exchange must.

Critics see it differently. A protocol that earns nine-figure fee volume, in aggregate, from stolen funds has an operational dependency on criminal demand, whether intended or not. Defenders see a neutral rail. The distinction increasingly matters to policymakers.

Why the 72-hour window matters

The first three days after a hack are the most active phase of fund movement. Attackers move fast before exchanges freeze addresses and analytics firms map the trail. THORChain's $46 million figure covers exactly that window, which suggests the protocol absorbed a meaningful share of the initial dispersal.

The fee estimate — more than $200,000 — is not enormous by DeFi standards. But it establishes a measurable, on-chain link between protocol revenue and proceeds of crime. That is precisely the kind of record investigators and regulators can quantify.

What comes next

The Bybit precedent already drew scrutiny to THORChain's role in laundering flows, and the Binance figures will intensify it. Expect continued pressure on the protocol's governance forums, and on the node operators who earn fees from routed volume, as enforcement agencies work through the Binance case in the months ahead.