THORSwap Pauses Platform After Series of FTX Hack-Linked Trades
A THORSwap developer said the team “stands firmly against any and all criminal actions” in a message to CoinDesk. After the move, the FTX Exploiter started swapping funds into the Threshold Network's tBTC tokens.

THORSwap exchange said on Friday it would shift into “maintenance” mode after a series of illicitly-linked funds were passed through the platform in the past several days – including several transactions originating from the infamous "FTX Exploiter" wallet that drained funds from Sam Bankman-Fried's FTX exchange in the days following its bankruptcy last year.
And according to one blockchain sleuth, Lookonchain, the exploiter has since started – early Friday – swapping ether (ETH) into the Threshold Network's tBTC tokens, a bridged form of bitcoin (BTC).
After @THORSwap suspended swaps, FTX Exploiter started swapping $ETH for $tBTC and cross-chained to the Bitcoin network through @TheTNetwork.
— Lookonchain (@lookonchain) October 6, 2023
So far, FTX Exploiter has swapped 75,636 $ETH($124M) for BTC assets and cross-chained to the Bitcoin network. pic.twitter.com/ksIPBzRJ0d
A THORSwap developer said the team “stands firmly against any and all criminal actions” in a message to CoinDesk.
“Yesterday, following a careful evaluation of the situation and consultation with advisors, legal counsel and law enforcement, the decision was made to temporarily transition the THORSwap interface into maintenance mode,” THORSwap developers said in a tweet.
“This action was taken to swiftly curtail any further potential illicit activity. THORSwap will remain in this mode until a more permanent and robust solution can be implemented to ensure the platform's continued security and integrity,” they added.
Fellow THORChads,
— THORSwap ⚡ #BetterThanCEX (@THORSwap) October 6, 2023
A pressing and persistent concern has recently come to light: the potential movement of illicit funds through THORChain and, specifically, THORSwap. Such activities have no place on the THORSwap platform, and THORSwap stands firmly against any and all criminal…
The move effectively pauses trading operations. However, services such as lending, borrowing and staking actions are all fully operational.
THORSwap runs on THORChain, a network that allows users to freely trade tokens between different blockchains.
In November 2022, hours after FTX and its related companies filed for bankruptcy, an unknown party managed to drain various wallets of as much as $600 million.
Last week, the hacker, whose identity remains unknown to this date, managed to pass over 15,000 ether using various platforms, including THORSwap. The funds' sudden movement on the eve of Bankman-Fried's criminal trial this week in a federal court in New York has deepened one of the ongoing mysteries around the exchange's collapse last year.
(UPDATE 13:36 UTC: Adds comments from Lookonchain about FTX Exploiter swapping ETH into tBTC.)
Bradley Keoun contributed reporting.
Sizin için daha fazlası
Protocol Research: GoPlus Security

Bilinmesi gerekenler:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
The Protocol: Stripe’s Tempo Testnet Goes Live

Also: ZKSync Lite to Sunset, Blockstream App Update, Axelar’s AgentFlux
What to know:
This article is featured in the latest issue of The Protocol, our weekly newsletter exploring the tech behind crypto, one block at a time. Sign up here to get it in your inbox every Wednesday.











