THORChain:
genuinely unmatched native cross-chain swaps, carrying the heaviest risk history in this series.
We tore apart THORChain, an independent Layer-1 blockchain functioning as a DEX at the network level since its 2021 mainnet launch, across the same seven-category scorecard we've used throughout this series. From a genuinely distinctive, unmatched core capability, real native-to-native swaps letting you trade actual Bitcoin for actual Ethereum without wrapped tokens, across a genuinely broad and growing set of chains, to what we can't set aside: three exploits in 2021 totaling roughly $16 million, a January 2025 solvency crisis that left the protocol with approximately $200 million in bad debt and required deprecating its lending products entirely, a $10.7-11 million vault drain in May 2026 via a threshold-signature-scheme vulnerability, and a genuinely distinctive, serious reputational concern we haven't found matched anywhere else in this series: THORChain's own infrastructure was reportedly used as a laundering conduit for two unrelated, massive hacks, the $1.5 billion Bybit hack and the $293 million KelpDAO hack; and landed on a score the marketing page won't show you.
Our take, up front: THORChain, launched in 2018 with mainnet in 2021, is best understood not as a single app but as an independent Layer-1 blockchain that functions as a DEX at the network level, holding liquidity in protocol vaults and coordinating swaps between native assets across chains using bonded nodes and threshold signature schemes, rather than wrapped tokens or a traditional bridge. Real, genuinely distinctive, unmatched core capability: true native-to-native swaps, letting users trade real Bitcoin for real Ethereum directly, a capability no other platform in this series offers at this scale. Real, genuinely broad, growing native-asset chain support: Bitcoin, Ethereum, BNB Chain, Avalanche, Cosmos, Dogecoin, Litecoin, Bitcoin Cash, XRP (added June 2025), TRON (added October 2025), and Base. Real, genuinely distinctive slip-based fee model, where fees scale with how much a trade impacts pool depth, and Streaming Swaps, which split large trades into smaller sub-swaps over time, reducing average slippage by 40-60% for trades exceeding $50,000 per one detailed source. Real, disclosed, genuine post-2021 security investments: a bug bounty up to $500,000, circuit breakers pausing specific chains on anomalous activity, and regular third-party audits. What we can't set aside: genuinely one of the most severe, multi-faceted security and financial-integrity histories we've documented in this entire series. Three exploits in 2021 totaled roughly $16 million. A January 2025 "THORFi crisis" left the protocol with approximately $200 million in bad debt from its lending products, requiring lending and impermanent loss protection to be removed entirely and a new TCY token created to address the debt. Most recently, on May 15, 2026, a vault drain exploiting a vulnerability in the protocol's GG20 threshold-signature scheme resulted in a loss of roughly $10.7-11 million across at least nine chains, first flagged by on-chain investigator ZachXBT and confirmed by PeckShield. Real, genuinely distinctive, significant reputational and regulatory concern unlike anything else we've found in this series: THORChain's infrastructure was reportedly used as a laundering conduit for two unrelated, massive hacks, the $1.5 billion Bybit hack in February 2025 and the $293 million KelpDAO hack in April 2026. Real, honestly severe, well-documented decline: TVL fell from roughly $329 million pre-crisis to a range our more current, detailed sources place between $39.5 million and $127 million; one source's claim of "zero major exploits" is flatly contradicted by multiple other, more detailed, better-corroborated sources documenting this actual incident history, and we're treating that claim as unreliable. We weighted all of it below.
Real, disclosed, genuine post-2021 security investments: a bug bounty up to $500,000, circuit breakers pausing specific chains on anomalous activity, and regular third-party audits. What we can't set aside: genuinely one of the most severe, multi-faceted security and financial-integrity histories we've documented in this series. Three exploits in 2021 totaled roughly $16 million. A January 2025 "THORFi crisis" left the protocol with approximately $200 million in bad debt from its lending products, requiring a restructuring via a new TCY token. Most recently, on May 15, 2026, a vault drain exploiting a vulnerability in the protocol's GG20 threshold-signature scheme resulted in a loss of roughly $10.7-11 million across at least nine chains, first flagged by on-chain investigator ZachXBT and confirmed by PeckShield. Real, genuinely distinctive, significant reputational and regulatory concern unlike anything else we've found in this series: THORChain's infrastructure was reportedly used as a laundering conduit for two unrelated, massive hacks, the $1.5 billion Bybit hack in February 2025 and the $293 million KelpDAO hack in April 2026.
Pros
- Disclosed bug bounty, circuit breakers, and regular audits following 2021 incidents
Cons
- Three 2021 exploits (~$16M); a $200M solvency crisis in Jan 2025; a $10.7-11M hack in May 2026
- Reportedly used as a laundering conduit for the $1.5B Bybit and $293M KelpDAO hacks
Real, honestly severe, well-documented decline: TVL fell from roughly $329 million pre-crisis to a range our more current, detailed sources place between $39.5 million and $127 million, depending on the exact date measured relative to the January 2025 crisis and the May 2026 hack. Real, one source claims TVL over $1 billion, a figure we're treating as an outlier given how sharply it diverges from our other, more specific and more recently-dated sources. Real, one source's direct claim of "zero major exploits" is flatly contradicted by multiple other, more detailed, better-corroborated sources documenting the platform's actual incident history.
Pros
- Continued, real chain integrations even through the crisis period (XRP, TRON)
Cons
- TVL fell from ~$329M pre-crisis to a $39.5-127M range across our most current sources
- One source's "zero major exploits" claim is directly contradicted by better-corroborated sources
Real, genuinely distinctive architecture: an independent Layer-1 blockchain with liquidity held in protocol vaults, secured by a bonded node set using threshold signature schemes rather than a single custodian. Real, genuinely honest, significant restructuring following the January 2025 crisis: lending products and impermanent loss protection were both removed entirely, and a new TCY token was created specifically to address the resulting bad debt, with TCY holders now receiving a disclosed 10% of protocol revenue.
Pros
- Genuinely distinctive, real decentralized vault architecture (bonded nodes, TSS)
- Honest, disclosed restructuring (TCY token) to address 2025 crisis debt
Cons
- Entire product lines (lending, IL protection) had to be removed after the 2025 crisis
Real, genuinely broad, growing native-asset chain support: Bitcoin, Ethereum, BNB Chain, Avalanche, Cosmos, Dogecoin, Litecoin, Bitcoin Cash, XRP (added June 2025), TRON (added October 2025), and Base, all without wrapped tokens. Real, genuinely distinctive core value proposition: true native-to-native swaps, letting users trade real Bitcoin for real Ethereum directly, a capability no other platform in this series offers at this scale.
Pros
- True native-to-native swaps across 11+ major chains, unmatched at this scale in this series
- Continued expansion even through crisis (XRP, TRON added in 2025)
Cons
- Genuinely complex, multi-chain vault architecture is precisely what's been repeatedly attacked
Real, a genuinely improved, more accessible native interface launched in December 2025. Real, genuinely distinctive Streaming Swaps feature, splitting large trades into smaller sub-swaps over time, reducing average slippage by 40-60% for trades exceeding $50,000 per one detailed source. Real, honest, significant retrenchment: impermanent loss protection and lending products were both removed following the 2025 crisis, a real reduction in what the platform now offers relative to its earlier feature set.
Pros
- Improved native interface (Dec 2025); Streaming Swaps for large-trade execution
Cons
- Lending products and impermanent loss protection both removed post-crisis
Real, genuinely distinctive slip-based fee model: fees scale with how much a given trade impacts pool depth, with smaller trades facing smaller fees and larger trades paying more, a design intended to compensate liquidity providers and discourage aggressive extraction. Real, precisely quantified base fees around 0.05-0.15% plus dynamic slippage.
Pros
- Distinctive slip-based fee model fairly rewards LPs relative to actual pool impact
- Precisely quantified, competitive base fees (0.05-0.15%)
Cons
- Dynamic slippage can add real, variable cost beyond the base fee on larger trades
Real, genuinely distinctive Streaming Swaps for reduced price impact on large trades. Real, native, non-wrapped, cross-chain swaps at a scale we haven't found matched elsewhere in this series. Real, limit orders added November 2025, showing continued development despite the platform's difficult history.
Pros
- Distinctive native cross-chain swaps; Streaming Swaps; limit orders (Nov 2025)
Cons
- Feature set has genuinely narrowed since the 2025 crisis (no more lending, no IL protection)
Access only through swap.thorchain.org or a verified third-party front-end, and confirm the domain directly.
Given the vault-based custody model and its documented history, avoid routing unusually large single swaps through the protocol at once; Streaming Swaps exist specifically to reduce this exposure for larger trades.
A genuinely unmatched technical achievement, carrying a genuinely unmatched risk history to go with it.
We want to be direct about something rare in this series: THORChain does something real that nothing else we've reviewed does at this scale, letting you trade actual native Bitcoin for actual native Ethereum with no wrapped tokens involved. That's a genuine, substantive contribution to what decentralized cross-chain trading can look like. We also don't think it would be responsible to let that technical achievement outweigh what the record actually shows: three 2021 hacks, a $200 million solvency crisis in 2025 serious enough to force the removal of entire product lines, a further hack in 2026, and a distinctive, serious reputational problem where the platform's own infrastructure was reportedly used to launder proceeds from two unrelated, massive hacks elsewhere. Vault-based custody of native assets across many chains is precisely the kind of complex, high-value target that has now been hit repeatedly. We think both facts deserve to sit next to each other honestly: a real technical breakthrough, and a real, still-unresolved pattern of serious failures.
The scorecard above is deliberately general. Whether THORChain is right for you depends heavily on which of these you already are.
The experienced user who specifically needs true native-to-native swaps without wrapped tokens or a bridge
This is genuinely the core, unmatched capability THORChain was built to deliver.
The trader moving larger amounts who specifically uses Streaming Swaps to reduce single-transaction exposure
This distinctive feature genuinely reduces the price impact and risk profile of a large single trade.
The user who fully researches the platform's crisis and hack history before committing meaningful capital
Given the severity of what we found, this diligence is a genuinely reasonable, necessary step here specifically.
Risk-averse users, or anyone prioritizing a clean, recent security record above all else
Given the severity and recency of the platform's incident history, this is a real, honest, significant consideration.
The scorecard covers the headline judgment calls. These four tables cover the specifics we didn't want to bury in prose; the full multi-year incident and crisis timeline, the laundering-conduit issue explained precisely, TVL presented transparently with a false claim flagged, and THORChain against the full field.
A multi-year timeline, 2021-2026
| When | What happened |
|---|---|
| 2021 | Three separate exploits totaling roughly $16 million |
| January 2025 | "THORFi crisis": ~$200 million in bad debt from lending products; restructured via a new TCY token |
| February 2025 | Infrastructure reportedly used as a laundering conduit for the $1.5 billion Bybit hack |
| May 2025 | TCY token launched; 10% of protocol revenue directed to debt holders |
| May 15, 2026 | $10.7-11 million vault drain via a GG20 threshold-signature-scheme vulnerability |
| April 2026 | Infrastructure reportedly used as a laundering conduit for the $293 million KelpDAO hack |
We're presenting the solvency crisis and the two direct exploits as distinct categories of failure; both represent real, serious harm to the platform's trust and finances, even though only two involved an external attacker exploiting code directly.
The laundering-conduit issue, explained
| Detail | |
|---|---|
| What happened | THORChain's own permissionless swap infrastructure was reportedly used to move stolen funds from two unrelated hacks |
| Bybit hack (Feb 2025) | $1.5 billion, one of the largest crypto exchange hacks on record |
| KelpDAO hack (Apr 2026) | $293 million |
| Why this matters | A real, distinctive regulatory and reputational concern distinct from THORChain being hacked itself |
This is a genuinely different kind of risk than anything else we've documented in this series: a platform's own permissionless design being used as a tool by unrelated bad actors, rather than the platform itself being the direct victim.
TVL, presented transparently
| Source | Figure cited |
|---|---|
| dexrank.com (pre-crisis reference) | ~$329 million |
| dexrank.com (post-crisis, Feb 2026) | ~$127 million |
| Spark (post-May-2026-hack) | ~$39.5 million |
| Baltex | "Over $1 billion," directly contradicted by our other, more specific sources |
The same Baltex source also claims "zero major exploits," a statement flatly contradicted by every other detailed source we found; we're treating this source as unreliable rather than using any of its figures.
THORChain against the full field
| DEX | Confirmed security/financial incidents |
|---|---|
| THORChain | Five (2021 x3, 2025 solvency crisis, 2026 hack) + laundering-conduit concern |
| Balancer | Four (2021, 2023, 2025, 2026) |
| Curve | Three (2023, 2025, 2026) |
| Raydium / dYdX / GMX | Two each |
| Uniswap / Aerodrome / Meteora | One each |
| Orca / PancakeSwap / Hyperliquid / Injective / Osmosis | None found in our research |
THORChain now holds the most extensive combined incident and crisis history of any DEX we've reviewed across this entire series.
We don't just want to hand you our number; we want to show you how it sits next to what other review desks and comparison sites have published. We've excluded one hack-specific incident report (a news report, not a general review) and one source that made a directly false "zero major exploits" claim contradicted by our other, more detailed sources.
Our score lands substantially below the aggregated industry average, one of the largest gaps we've found in this series; most general roundup and comparison content credits the genuine technical achievement of native cross-chain swaps heavily, while giving comparatively less weight to the full severity of the 2025 solvency crisis and the laundering-conduit concern than our methodology does.
| Source | Score | Type |
|---|
Scores compiled by our editorial team from publicly available reviews as of August 2026. "Editorial estimate" means the outlet didn't publish a single numeric score, so we converted their published verdict and sentiment into a comparable 100-point figure. Verify current figures directly with each source before citing them elsewhere.
Yes, multiple times: three exploits in 2021 totaling roughly $16 million, and a $10.7-11 million vault drain on May 15, 2026 via a threshold-signature-scheme vulnerability. It also experienced a separate $200 million solvency crisis in January 2025.
A solvency crisis where the protocol's lending products accumulated approximately $200 million in bad debt. Lending and impermanent loss protection were both removed entirely, and a new TCY token was created to help address the debt, with TCY holders now receiving 10% of protocol revenue.
THORChain's own permissionless swap infrastructure was reportedly used to move stolen funds from two unrelated hacks: the $1.5 billion Bybit hack (February 2025) and the $293 million KelpDAO hack (April 2026). THORChain wasn't the victim in these cases; its infrastructure was reportedly used as a tool by unrelated bad actors.
Bridges typically create wrapped or synthetic versions of an asset on a destination chain. THORChain enables true native-to-native swaps, letting you trade real Bitcoin for real Ethereum directly, using liquidity pools and bonded nodes rather than wrapped-token IOUs.
A feature that splits a large trade into smaller sub-swaps executed over time, reducing average slippage by 40-60% for trades exceeding $50,000 per one detailed source, making larger transactions more efficient and less exposed at any single moment.
A base fee around 0.05-0.15%, plus a dynamic slip-based fee that scales with how much your trade impacts pool depth; larger trades relative to pool size pay more.
Our most current, detailed sources place it between roughly $39.5 million and $127 million, down substantially from a pre-crisis level around $329 million. One source's claim of over $1 billion is inconsistent with our other, more specific sources and should be treated with caution.
Bitcoin, Ethereum, BNB Chain, Avalanche, Cosmos, Dogecoin, Litecoin, Bitcoin Cash, XRP (added June 2025), TRON (added October 2025), and Base, all as true native assets without wrapping.
More Reviews
Balancer – DEX Review
Score: 47/100. The most incidents in this series: four since 2021, including a $116-128M hack that hit twice-audited code.
Read More
Hyperliquid – DEX Review
Score: 73/100. Dominant perp DEX, but closed-source code and the JELLY delisting controversy are real, unresolved trust questions.
Read More
Vertex – DEX Review
Score: 62/100. Sophisticated cross-margin trading, reviewed mid-migration to a new chain with conflicting founder accounts.
Read More
Raydium – DEX Review
Score: 68/100. Solana's liquidity leader, carrying two confirmed incidents and a real, wide gap in third-party security ratings.
Read More