THORSwap DEX enters maintenance mode amid illicit activity

Quick Take

  • THORChain-based decentralized exchange THORSwap is “temporarily transitioning” its interface into maintenance mode in a move designed to curtail a rise in potentially illicit funds moving through the platform.
  • The party known as the “FTX hacker” transferred 22,500 ETH ($38 million) over the past week, including swapping ether for bitcoin through THORChain.

THORChain RUNE +1.13% -based decentralized exchange THORSwap announced it is “temporarily transitioning” its interface into maintenance mode amid a rise of potentially illicit funds moving through the platform.

“A pressing and persistent concern has recently come to light: the potential movement of illicit funds through THORChain and, specifically, THORSwap,” THORSwap posted on X (formerly Twitter). “Such activities have no place on the THORSwap platform, and THORSwap stands firmly against any and all criminal actions.”

The move follows consultation with legal experts, advisors and law enforcement agencies, and the platform will remain in maintenance mode until “a more permanent and robust solution can be implemented to ensure the platform's continued security and integrity,” THORSwap stated.

"Swaps are paused. LP actions, Earn (savers), Borrow (lending), Staking actions are all fully operational," it later added.

FTX hacker fund movements

The individual or entity behind suspicious withdrawals from the collapsed crypto exchange FTX — commonly called the "FTX hacker" —  transferred 22,500 ETH ($38 million) over the past week, according to on-chain analysts Lookonchain. 

The transfers involved swapping ether for bitcoin through THORChain and Railgun. The FTX hacker holds over 163,000 ETH ($275 million) across several wallets.


Keep up with the latest news, trends, charts and views on crypto and DeFi with a new biweekly newsletter from The Block's Frank Chaparro

By signing-up you agree to our Terms of Service and Privacy Policy
By signing-up you agree to our Terms of Service and Privacy Policy

The FTX hacker is already reportedly exploring alternatives to THORSwap for converting ether into bitcoin, including Threshold Network, according to on-chain data. Threshold later posted it had released a patch and "the remaining pending FTX exploiter redemption transactions are not expected to process."

Taylor Monahan, a product manager a Consensys, claimed on Monday that hackers and money launderers in Russia and North Korea use THORChain for their operations, adding that “in the last four months, more than 50% of the ether to THORSwap router to bitcoin transactions have been stolen funds.”

Transaction volume on THORChain has increased significantly this month, hitting a record $355 million on Oct. 5, according to THORChain Explorer.

Swap history volume. Image: THORChain Explorer.

The THORSwap team said it had no additional details to share at this time but assured its community they were doing everything possible to resume operations swiftly and further updates would follow.

Updated with additional detail throughout.

Disclaimer: The former CEO and majority shareholder of The Block has disclosed a series of loans from former FTX and Alameda founder Sam Bankman-Fried.

© 2023 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

About Author

James Hunt is a reporter at The Block, based in the UK. As the writer behind The Daily newsletter, James also keeps you up to speed on the latest crypto news every weekday. Prior to joining The Block in 2022, James spent four years as a freelance writer in the industry, contributing to both publications and crypto project content. James’ coverage spans everything from Bitcoin and Ethereum to Layer 2 scaling solutions, avant-garde DeFi protocols, evolving DAO governance structures, trending NFTs and memecoins, regulatory landscapes, crypto company deals and the immersive metaverse. You can get in touch with James on Twitter or Telegram via @humanjets or email him at [email protected].


To contact the editor of this story:
Ryan Weeks at
[email protected]