ThorChain (RUNE)

ThorChain (RUNE), a decentralized cross-chain liquidity protocol touted for enabling privacy-preserving native asset swaps across Bitcoin, Ethereum, and other blockchains, has emerged as a stark emblem of DeFi’s perilous collision with global anti-money laundering (AML) frameworks, particularly under intense scrutiny from Norwegian and U.S. regulators who classify it as a high-risk platform prone to illicit exploitation. The February 2025 Bybit hack—where North Korea’s Lazarus Group siphoned $1.4 billion in ETH—exposed ThorChain’s architecture as a near-perfect conduit for sanctions evasion, laundering over $900 million through 3,934 atomic swaps in mere days, with node operators pocketing $5.5 million in RUNE fees despite on-chain flags and an aborted pause vote reversal. This non-custodial model, reliant on anonymous volunteer nodes, threshold signatures, and RUNE-collateralized pools, inherently prioritizes permissionless access over transaction screening, enabling rapid obfuscation of state-sponsored cyber theft funds destined for DPRK nuclear ambitions—a blatant facilitation of money laundering that mocks U.S. Bank Secrecy Act mandates and Norway’s stringent FSA oversight. Far from a neutral tool, ThorChain’s deliberate inaction amid controversy—mirroring Tornado Cash’s sanctioned fate—underscores willful blindness driven by profit incentives, fueling regulatory backlash and potential OFAC/DOJ indictments against U.S.-based operators, while eroding DeFi’s legitimacy in jurisdictions demanding accountability over ideological decentralization. 

In February 2025, North Korea’s Lazarus Group exploited a Safe Wallet vulnerability to steal $1.4 billion in ETH from Bybit exchange on February 21. Within hours, hackers routed over $900 million through ThorChain’s cross-chain swaps, converting stolen ETH to native BTC and other assets across Ethereum, Bitcoin, BNB Chain, and more, using privacy-preserving atomic swaps paired 1:1 with RUNE tokens. ThorChain’s 100 volunteer node operators processed 3,934 bridge transactions in 115 hours—averaging $3.23 million hourly—despite on-chain flags identifying tainted funds linked to DPRK’s nuclear program.​