THORChain Developer Exits Amid Bybit Asset Laundering Scandal

The lead developer of the THORChain protocol, known as Pluto, has announced his departure. This decision came after the cancellation of a vote regarding the freezing of transactions linked to hackers from the Lazarus Group, which was involved in a recent hack of Bybit.

«As of now, I will no longer be involved in the development of THORChain,» the programmer stated.

Pluto mentioned that he would remain available during the transition of responsibilities.

In response to Pluto’s decision, a validator known as TCB also expressed his willingness to leave if the protocol did not take steps to curb the flow of illicit funds. The node operator was among three participants who voted in favor of freezing the assets.

“Halting the chain is an operational adjustment. It requires three votes to enact and four to revoke. The vote was canceled within minutes. This is decentralization in action,” explained THORChain developer Oleg Petrov.

Alongside Pluto and TCB, the developer advocated for freezing the hackers’ assets. He noted that, although he does not control a node and could not participate in governance decisions, he had created the necessary code.

The Lazarus Group has been actively using THORChain to launder approximately $1.46 billion in cryptocurrency stolen from Bybit. According to Lookonchain, the hackers transferred around 270,000 ETH, worth about $605 million, into the protocol.

One commentator rightly pointed out that the protocol does not launder funds but merely facilitates their exchange. He added that the subsequent movement of assets can be tracked.

Daily swap volumes on THORChain surged sharply following the Bybit attack, with figures approaching $860 million on February 26, and reaching $705 million the next day.

The FBI has confirmed the involvement of Lazarus in the exchange’s hack. The agency released a list of Ethereum addresses associated with the group and advised crypto platforms to avoid engaging with these wallets.

“When the overwhelming majority of your flows consist of stolen funds from North Koreans acquired during the largest heist in human history, it becomes a matter of national security and is no longer a game,” wrote TCB.

In another comment, the validator noted that, given the current situation, seeking to scale the protocol through institutional capital inflows would be unrealistic. Institutions will not allow their funds to be mixed with illicit earnings, he emphasized.

According to DeFi Llama, the total value locked (TVL) in THORChain’s liquidity pools has dropped from a peak of around $446 million in December to $186 million at the time of writing.

As a reminder, earlier in February, the protocol’s validators approved a proposal to resolve a debt crisis of approximately $200 million by converting obligations into a new token.