THORSwap moves to “maintenance mode” after criminals linked to the FTX hack in 2022 used the decentralized exchange to convert $38M worth of ether to bitcoin
James Hunt / The Block :
Context & Ripple Effects
The alleged theft occurred amid FTX’s collapse, when the exchange was moving remaining funds to cold wallets after unauthorized transactions. A later account described FTX staff’s overnight effort to contain the heist, while a wallet tied to the suspected attacker had already shifted roughly $49 million of stablecoins into ether.
This episode adds a cross-asset conversion route to the aftermath: later reporting said U.S. authorities charged three people over a phone-hacking scheme that included the FTX hack. It also foreshadowed continued scrutiny of swap infrastructure after Bybit-linked hackers were reported using THORChain swaps to move ether toward bitcoin.
First-order effects
- THORSwap’s move to maintenance mode curtails normal use of the venue while it responds to activity tied to the FTX theft.
- Actors holding the converted bitcoin face a disrupted route for further swaps through THORSwap; ordinary users of the protocol also lose access to its usual service.
Second-order effects
- The incident puts other decentralized swap services under pressure to show how they respond when identifiable stolen funds use their infrastructure, even where transactions are not routed through a conventional exchange.
- The reported ether-to-bitcoin conversions make asset-tracing across chains more central to investigations, rather than focusing solely on the original ether holdings.
Third-order effects
- If protocol shutdowns or service restrictions become the recurring response to illicit use, decentralized exchange operators will increasingly be judged on operational controls as well as non-custodial design.
- The broader tension is likely to persist: cross-chain liquidity can improve user access while also creating harder-to-monitor paths for proceeds from major exchange breaches.
The trend: High-profile crypto thefts are turning cross-chain swap venues into a focal point for the trade-off between permissionless liquidity and responses to identifiable illicit activity.