The decentralized SWAP platform THORChain experienced trading volume jump from zero to more than 1 billion dollars during 48 hours following the extra activity by users trying to cleanse their stolen funds after the Bybit hackers’ attacks.

The THORChain Explorer numbers show the platform set new volumes on February 26 by swapping $859.61 million and reached $210 million more the following day. Data shows a wave of trading activity after Bybit lost $1.4 billion.

THORChain Connects Blockchains For Swaps

THORChain connects blockchains to help users swap digital assets between them especially when exchanging Ether for Bitcoin. The platform’s recent high volume operation brings both new records and a fresh review of its functions to handle illegal money.

After racking up $200 million in borrowing debt THORChain needed to freeze and Ether lending in January to start its debt restructuring process. While the lending services are frozen users can still use the swap function.

Pluto from Nine Realms stated that illegal money entered the system but explained that the team would aid wallet and integration partners to build screening systems.

Bybit has created a website to monitor stolen funds published online. The platform passes money rewards to exchanges and parties willing to freeze detected illegal funds. Up to Feb. 27 the website acknowledged eight parties including eXch which refused mandatory cooperation.

THORChain Freezes Lending To Restructure

People criticize eXch for refusing to block assets from the Bybit hack even though it is not a KYC service provider. Despite these assertions the platform maintains it never moved North Korean funds through its platform.

Lazarus conducted the Feb. 21 exploit on Bybit by first accessing stolen SafeWallet login data according to block investigator ZachXBT and FBI confirmation. Future reports from Verichains and Sygnia show that criminals stole Safe developer access then tricked signers into submitting malware through the system.

Validating their findings Sygnia specialists found that criminals introduced dangerous JavaScript code into SafeWallet’s internet servers. SafeWallet developers rebuilt their security system after the attack by moving their platforms and updating access measures to defend their systems.