THORChain income reached a record $3.01 million in September 2026 for the cross-chain exchange protocol. 01 million in system income for September 2026. A substantial 63% of this unprecedented THORChain income — roughly $1.9 million — was generated during an intense five-day period.
This surge directly followed the Bitget cryptocurrency exchange hack on September 24, 2026, as funds linked to the exploit moved through the decentralized network.
The incident highlights the complex interplay between centralized exchange vulnerabilities and the permissionless nature of decentralized finance. While Bitget sought to limit the movement of stolen assets, THORChain staunchly defended its operating principles, refusing to intervene in transactions it deemed akin to those on Bitcoin or Ethereum.
Analyzing THORChain income in September
September’s performance marks THORChain’s highest monthly income since March 2025. The protocol also saw its swap volume soar to $2.40 billion, a level not witnessed since June 2025. This exceptional activity represented a significant leap from August, when system income stood at $615,000 and swap volume was $613 million.
Much of this dramatic increase occurred between September 25 and September 29. During these five days, approximately $1.37 billion in swap volume, accounting for 57% of September’s total, traversed the THORChain network. The daily volume during this concentrated period fluctuated between $190 million and $460 million, illustrating the sheer scale of the transactions.
On September 25 alone, THORChain recorded its highest daily revenue since April 25, 2026, reaching between $381,700 and $382,000. That same day, daily trading volume hit $211 million, second only to the $280 million seen on September 10. These figures underscore how swiftly and substantially the Bitget hack-linked activity impacted THORChain’s financials.
Decentralized Stance Sparks Controversy
The concentration of trading activity came with controversy. Bitget CEO Gracy Chen publicly urged THORChain to “refuse service to these addresses” associated with the attackers. However, THORChain quickly rejected these calls for selective intervention, emphasizing its core design as a decentralized and permissionless protocol.
The protocol’s response likened its operational model to those of major blockchain networks such as Bitcoin, Ethereum, and BNB Chain. They argued that holding THORChain responsible for handling “known stolen funds” would be equivalent to blaming these foundational blockchains for similar movements. This stance highlights a fundamental ideological divide within the crypto ecosystem.
THORChain drew a clear distinction between a network halt, an emergency measure designed to protect the protocol itself, and censoring individual transactions. It referenced its own May exploit, where attackers stole $10.7 million from liquidity pools. Those attackers were not subsequently blacklisted from using the network, reinforcing THORChain’s consistent position on censorship resistance.
Bitget Exploit: Anatomy of a Breach
The catalyst for THORChain’s income surge was the significant security breach at Bitget, a major cryptocurrency exchange, on September 24, 2026. Attackers managed to transfer an estimated $387.5 million to $388 million from Bitget’s hot and warm wallet infrastructure. This substantial sum moved across multiple blockchains, triggering the torrent of activity seen on THORChain.
Investigations later revealed the attackers exploited a zero-day vulnerability within a third-party security product used by Bitget. They obtained high-level internal credentials, which allowed them to issue fraudulent withdrawal commands. Crucially, Bitget’s CEO Gracy Chen confirmed that the attackers did not steal private keys, but rather bypassed the exchange’s existing risk controls.
The earliest signs of malicious activity within Bitget’s systems were traced back to August 31, 2026, nearly a month before the actual theft. Following the incident, Bitget engaged leading security firms Mandiant, a Google Cloud company, and SlowMist to conduct independent investigations.
Only a minimal amount, $318,000, or 0.08% of the stolen funds, was frozen by stablecoin issuers Circle and Tether, further underscoring the challenge in reclaiming stolen crypto.
Despite the substantial losses, Bitget assured users that its User Protection Fund, which exceeds $464 million, would cover all affected assets. This proactive measure aims to mitigate the impact on its customer base and maintain trust in the wake of the extensive breach.
User Metrics Lag Behind Revenue Growth
While THORChain’s financial metrics soared, its underlying user growth remained comparatively modest. Active wallets on the network increased to 25,000 in September from 23,500 in August. New wallets also edged up slightly, from 21,800 to 22,400 during the same period. These figures suggest that the dramatic revenue increase didn’t stem from a widespread expansion of its user base.
Instead, the data points to concentrated transactions from a relatively small number of participants. This implies the surge was driven by large, singular flows—likely the movement of the stolen Bitget funds—rather than organic growth in regular trading. This distinction is crucial for understanding the true health and sustainable economics of the protocol.
The burst in activity also artificially inflated trailing yield measures for THORChain’s native token. RUNE’s seven-day annualized return peaked at 69.03% on September 29, with TCY climbing to 29.74%. However, THORChain itself anticipates these readings will decline as the high-fee days from the hack-linked surge eventually fall outside the calculation window, revealing more normalized performance.
The Challenge of Sustainable Growth for THORChain
The exceptional September performance presents a significant challenge and opportunity for THORChain. The immediate test lies in whether the protocol can replace the episodic, hack-driven activity with sustained, ordinary trading volume. If trading normalizes to pre-hack levels without a corresponding boost in user engagement, both income and trailing yields could experience a sharp retreat.
For long-term health, THORChain needs to convert the heightened visibility gained from this incident into recurring flow from legitimate traders and integrators. Reliance on infrequent, large transactions, often associated with illicit activity, isn’t a viable or desirable path for consistent growth. The focus now shifts to demonstrating the protocol’s utility beyond crisis situations.
Beyond the protocol’s direct income, frontend affiliates also saw a boost, collectively earning approximately $840,700 during September. A substantial $669,000 of this went to unidentified affiliates, with about $259,718 directly attributable to the Bitget-linked swaps. The largest individual recipient reportedly received around $177,499 from this activity. This illustrates the broader financial ecosystem benefiting from high-volume events.
Liquidity providers and token holders will be watching closely to see if September’s unusual returns become a blueprint for future growth, or merely an anomaly. The coming months will determine if THORChain can outpace its competitors through organic adoption, rather than through external events. Bitget, meanwhile, continues to manage the fallout from its own security incident, reinforcing the ongoing risks in the centralized crypto landscape.
The broader implications for the decentralized finance sector are also noteworthy. The incident reignites debates about the responsibility of permissionless protocols when faced with illicit funds. As the crypto market matures, the tension between decentralization ideals and the need for accountability will likely continue to shape regulatory and operational approaches.
This event serves as a stark reminder of the volatile nature of digital assets and the intricate web of interactions between different platforms.