THORChain made 63% of its record $3 million September income during the Bitget hack-linked trading surge

THORChain’s September income surged as Bitget-linked flows drove the protocol’s busiest stretch in more than a year.

The cross-chain exchange generated $3.01 million in system income last month, its highest since March 2025, while swap volume climbed to $2.40 billion, the most since June 2025.

Much of that activity was compressed into five days following the Bitget hack. About $1.37 billion, or 57% of September’s swap volume, crossed THORChain between Sept. 25 and Sept. 29, while the network generated roughly $1.9 million of income during the same period, equivalent to about 63% of the monthly total.

THORChain said the surge coincided with funds linked to the Bitget exploit moving through the network. It explained:

“Between September 25 and 29, daily volume ran between roughly $190M and $460M as funds linked to the Bitget exploit moved through the network.”

The concentration nevertheless highlights the economic consequences of a position THORChain defended as Bitget sought to limit the movement of stolen funds.

After the exchange was hacked, THORChain rejected calls for selective intervention, arguing that the protocol is decentralized and permissionless in the same way as Bitcoin, Ethereum and BNB Chain.

It also distinguished a network halt, an emergency mechanism designed to protect THORChain itself, from censoring individual addresses or transactions. The protocol pointed to its own May exploit, when attackers stole $10.7 million from liquidity pools but were not blacklisted from swapping assets through the network afterward.

Bitget said roughly $387.5 million was ultimately transferred to attacker-controlled addresses during the September breach.

THORChain's record activity came without a user boom

THORChain’s wallet data suggests the revenue jump reflected unusually large flows rather than a comparable expansion in its user base.

Active wallets increased to 25,000 in September from 23,500 in August, while new wallets edged up to 22,400 from 21,800. THORChain said wallet activity barely responded to the late-month volume spike, pointing to concentrated transactions from a relatively small number of participants.

That distinction complicates the headline improvement in protocol economics.

September income was almost five times August’s $615,000, while swap volume nearly quadrupled from $613 million. Yet most of the incremental activity came during the same narrow period when hack-linked assets moved across chains.

The burst also inflated trailing yield measures. RUNE’s seven-day annualized return reached 69.03% on Sept. 29, while TCY’s climbed to 29.74%. THORChain expects those readings to decline as the high-fee days roll out of the calculation window.

Frontend affiliates separately earned about $840,700 during September, with roughly $669,000 going to unidentified affiliates.

For liquidity providers and token holders, the next test is whether ordinary trading can replace the exceptional activity that lifted September’s returns.

If volume normalizes toward pre-hack levels while wallet growth remains modest, income and trailing yields could retreat sharply. A sustained improvement would require THORChain to convert September’s visibility into recurring flow from traders and integrators rather than rely on episodic bursts generated by unusually large transactions.