Bybit’s illicit funds laundering has earned THORChain almost $3 billion in trading volume and $3 million in fee revenue. 

THORChain (RUNE), a cross-chain swap protocol, saw a massive surge in activity as the Bybit’s hacker laundered funds through its platform. According to on-chain analyst Yu Jin, the hackers, the North Korean Lazarus group, converted the stolen Ethereum (ETH) into Bitcoin (BTC) using THORChain, generating a trading volume of $2.91 billion and earning the protocol $3 million in fees.

Before the laundering began, THORChain’s average daily transaction volume was about $80 million. However, from Feb. 22 onward, the figure rose to an average of $580 million per day, totaling $2.91 billion in just five days. On Feb. 26 alone, THORChain processed $859.61 million in swaps, its highest-ever daily volume, and added $210 million more on Feb. 27, bringing the total to over $1 billion within 48 hours, according to THORChain Explorer.

Swapping stolen funds for Bitcoin is a known tactic of the North Korean hacking group Lazarus, which has been reported to use this method to obscure the trail of ill-gotten digital assets.

THORChain core developer and Nine Realms engineer, known as “Pluto,” acknowledged that illicit funds had passed through the protocol. He added that the team is actively working with wallet and integration partners to implement screening services to address this issue.