MetaMask Head of Security Taylor Monahan says the Bybit hackers have moved at least 209,384 ETH, of ~400,000 stolen, onto Bitcoin, largely using THORChain swaps
Daniel Kuhn / The Block :
Context & Ripple Effects
The reported conversion follows Bybit’s disclosure that a hacker had taken control of a cold Ethereum wallet, producing an estimated $1.5 billion token loss. It turns the incident from a custody breach into a tracing and liquidation problem across chains.
THORChain’s role revives a recurring tension for cross-chain swap venues: THORSwap previously entered maintenance mode after illicit ETH-to-BTC conversions tied to the FTX hack. Follow-on Bybit coverage said a large share of the stolen funds was still traceable even after substantial ETH-to-BTC conversion.
First-order effects
- The attackers have shifted at least 209,384 ETH into Bitcoin, largely through THORChain swaps, changing the asset and chain investigators must follow.
- Bybit, MetaMask’s security team, and tracing firms must prioritize transaction paths spanning Ethereum, THORChain, and Bitcoin rather than Ethereum wallets alone.
Second-order effects
- THORChain and comparable cross-chain swap services face renewed scrutiny over whether their interfaces or counterparties can limit or identify laundering flows without interrupting legitimate swaps.
- The conversion complicates asset recovery: later coverage reported more than 77% of the stolen funds remained traceable, but BTC movement creates a different set of address-clustering and off-ramp monitoring challenges.
Third-order effects
- If major thefts repeatedly use cross-chain swaps to change assets, security and compliance efforts will increasingly be organized around transaction paths across networks, not controls at a single exchange or blockchain.
- The pattern may intensify the trade-off between permissionless cross-chain liquidity and pressure for intervention by the applications and services built around it.
The trend: Large crypto thefts are increasingly testing whether cross-chain liquidity can outpace coordinated tracing and recovery efforts.