Share this article

THORSwap Pauses Platform After Series of FTX Hack-Linked Trades

A THORSwap developer said the team “stands firmly against any and all criminal actions” in a message to CoinDesk. After the move, the FTX Exploiter started swapping funds into the Threshold Network's tBTC tokens.

Updated Oct 6, 2023, 1:43 p.m. Published Oct 6, 2023, 6:24 a.m.
The recent call for a "pause" on AI innovation should be seen as a red flag. (أخٌ‌في‌الله /Unsplash, modified by CoinDesk)
The recent call for a "pause" on AI innovation should be seen as a red flag. (أخٌ‌في‌الله /Unsplash, modified by CoinDesk)

THORSwap exchange said on Friday it would shift into “maintenance” mode after a series of illicitly-linked funds were passed through the platform in the past several days – including several transactions originating from the infamous "FTX Exploiter" wallet that drained funds from Sam Bankman-Fried's FTX exchange in the days following its bankruptcy last year.

And according to one blockchain sleuth, Lookonchain, the exploiter has since started – early Friday – swapping ether (ETH) into the Threshold Network's tBTC tokens, a bridged form of bitcoin (BTC).

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the The Protocol Newsletter today. See all newsletters

A THORSwap developer said the team “stands firmly against any and all criminal actions” in a message to CoinDesk.

“Yesterday, following a careful evaluation of the situation and consultation with advisors, legal counsel and law enforcement, the decision was made to temporarily transition the THORSwap interface into maintenance mode,” THORSwap developers said in a tweet.

“This action was taken to swiftly curtail any further potential illicit activity. THORSwap will remain in this mode until a more permanent and robust solution can be implemented to ensure the platform's continued security and integrity,” they added.

The move effectively pauses trading operations. However, services such as lending, borrowing and staking actions are all fully operational.

THORSwap runs on THORChain, a network that allows users to freely trade tokens between different blockchains.

In November 2022, hours after FTX and its related companies filed for bankruptcy, an unknown party managed to drain various wallets of as much as $600 million.

Last week, the hacker, whose identity remains unknown to this date, managed to pass over 15,000 ether using various platforms, including THORSwap. The funds' sudden movement on the eve of Bankman-Fried's criminal trial this week in a federal court in New York has deepened one of the ongoing mysteries around the exchange's collapse last year.

(UPDATE 13:36 UTC: Adds comments from Lookonchain about FTX Exploiter swapping ETH into tBTC.)

Bradley Keoun contributed reporting.

More For You

Protocol Research: GoPlus Security

GP Basic Image

What to know:

  • As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
  • GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
  • Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

More For You

Solana’s Drift Launches v3, With 10x Faster Trades

Drift (b52_Tresa/Pixabay)

With v3, the team says that about 85% of market orders will fill in under half a second, and liquidity will deepen enough to bring slippage on larger trades down to around 0.02%.

What to know:

  • Drift, one of the largest perpetuals trading platforms on Solana, has launched Drift v3, a major upgrade meant to make on-chain trading feel as fast and smooth as using a centralized exchange.
  • The new version will deliver 10-times faster trade execution thanks to a rebuilt backend, marking the largest performance jump the project has made so far.