THORChain recorded its highest monthly income in six months during September, generating $3.01 million in system revenue as swap volume reached $2.40 billion. However, the bulk of this activity was concentrated during a narrow five-day window following the Bitget exchange hack.
Between September 25 and 29, approximately $1.37 billion in swap volume crossed THORChain, representing 57% of the month's total. During those same five days, the network generated roughly $1.9 million in income, equivalent to about 63% of September's monthly total.
THORChain acknowledged that the surge coincided with funds linked to the Bitget exploit moving through the network, with daily volumes ranging between approximately $190 million and $460 million during the period. When Bitget sought to limit movement of the stolen funds, THORChain maintained its policy of operating as a permissionless protocol, arguing it functions similarly to Bitcoin, Ethereum, and BNB Chain.
The protocol distinguished between network halts—an emergency mechanism to protect THORChain itself—and censoring individual transactions or addresses. THORChain referenced its own May exploit, in which attackers stole $10.7 million from liquidity pools but were not blacklisted from subsequent swaps. Bitget reported that approximately $387.5 million was transferred to attacker-controlled addresses during the September breach.
User Growth Did Not Match Revenue Surge
THORChain's wallet data suggests the revenue spike reflected unusually large transactions rather than meaningful user expansion. Active wallets increased to 25,000 in September from 23,500 in August, while new wallets rose only slightly to 22,400 from 21,800. The protocol noted that wallet activity showed minimal response to the late-month volume spike, indicating concentrated transactions from a relatively small participant base.
September income climbed nearly five times from August's $615,000, while swap volume nearly quadrupled from $613 million. Yet most incremental activity occurred during the narrow period when hack-related assets moved across chains.
Elevated Yield Metrics Expected to Decline
The burst of activity temporarily inflated yield measures. RUNE's seven-day annualized return reached 69.03% on September 29, while TCY's climbed to 29.74%. THORChain indicated these readings should decline as the high-fee days exit the calculation window.
Frontend affiliates earned approximately $840,700 during September, with roughly $669,000 going to unidentified affiliates. For the protocol's sustainability, the key question is whether ordinary trading can sustain the exceptional returns generated by hack-related flows. If volume normalizes to pre-hack levels while wallet growth remains modest, income and yields could retreat significantly. Sustained improvement would require THORChain to convert September's visibility into recurring flow from traders and integrators rather than depend on episodic bursts from unusually large transactions.
