THORChain pulled in $3.01 million in September, as trading tied to the Bitget hack sent swap volume to a 15-month high. The windfall has sparked debate over protocol neutrality and whether such gains can last.
Money moved fast through THORChain in late September. Over just five days, the decentralized exchange raked in $1.9 million as funds from the Bitget hack poured across its cross-chain network. That single burst made up 63% of THORChain's monthly revenue, pushing total income to $3.01 million and swap volume to $2.40 billion-the highest marks since early 2025.
Concentrated flows
This wasn't a slow, steady climb. THORChain's own data shows that from September 25 to 29, daily swap volume jumped between $190 million and $460 million as assets linked to the Bitget exploit moved through the system. In those five days, $1.37 billion-57% of the month's total-was funneled through the protocol. Wallet activity barely budged: active wallets ticked up from 23,500 in August to 25,000 in September, and new wallets reached 22,400. Most of the late-month action came from a handful of users moving unusually large sums, not from a broad wave of new traders.
Bitget reported that attackers withdrew approximately $387.5 million from hot and warm wallets, but user balances and cold storage remained unaffected.
THORChain stuck to its principles. The team refused to block or censor transactions, pointing to the protocol's decentralized, permissionless setup. They drew a line between shutting down the whole network in a crisis and blacklisting single addresses. The protocol referenced its own May exploit, when $10.7 million was stolen and attackers still had access to the platform. Bitget said the attack started on September 24, 2025, at 18:31 UTC. Once the exchange spotted the unauthorized transfers, it halted withdrawals. Bitget confirmed that after the breach was contained, no more unauthorized transfers took place, and its non-custodial Bitget Wallet stayed untouched.
Protocol neutrality under scrutiny
THORChain's hands-off approach mirrors what Bitcoin and Ethereum have done, but the fallout is clear. By not freezing or filtering hack-linked funds, the protocol cashed in on a rush of swap fees as stolen assets were swapped across chains. This windfall sent yield metrics soaring: RUNE's seven-day annualized return hit 69.03% on September 29, and TCY's reached 29.74%. Even THORChain admitted these numbers would likely drop as the high-fee days faded from the rolling average.
Frontend affiliates got a cut too, pocketing $840,700 in September. Of that, $669,000 went to unnamed partners. But there's a catch: if trading volume drops back to pre-hack levels and wallet growth stays slow, both income and yield could fall just as quickly. The real test for THORChain is whether it can turn September's spike in attention into steady, organic trading from real users and integrators, instead of relying on one-off surges tied to security breaches.
The Bitget incident impacted around 12 addresses, 13 assets, and 11 networks-including Ethereum, XRP Ledger, Zcash, Tron, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia. Bitget stated that its Protection Fund, valued at over $464 million, would cover the financial loss.
September's results left August in the dust. THORChain's income was nearly five times higher than August's $615,000, and swap volume almost quadrupled from $613 million. Still, the fact that so much activity centered on the Bitget hack makes it hard to call this real growth. The episode shows the friction between permissionless design and the messy reality of cross-chain asset flows, especially when hacks are involved. Other exchanges have faced similar choices, as covered earlier in the context of crypto risk and direct exposure.
For liquidity providers and token holders, the coming months will show if THORChain can keep up strong returns without the artificial boost from hack-driven trades. If not, September's windfall could end up as a one-off blip, not a new baseline.
The numbers tell the story. THORChain pulled in $3.01 million in income and handled $2.40 billion in swaps for September. Of that, $1.37 billion in volume and $1.9 million in income came in just five days. Active wallets rose by 1,500 from August, and new wallets increased by 600. Frontend affiliates earned $840,700, and RUNE's seven-day annualized return peaked at 69.03% before the expected cooldown.
Decentralized exchanges like THORChain are built so anyone can move assets freely, without gatekeepers. That's the core of DeFi, but it also means these protocols can become pipelines for illicit funds when big hacks hit. While some networks could technically block transactions, most-including THORChain-only consider that option for threats that could take down the whole system, not for single incidents. The upshot: high-fee, high-volume periods tied to exploits can skew revenue and yield stats, making it tough for users and liquidity providers to judge the platform's real health and staying power.
