AFX Trade exploiter’s THORChain swap renews scrutiny of DeFi laundering routes
A $24m Arbitrum bridge hack saw stolen ETH converted to Bitcoin via THORChain, reviving concerns over unregulated cross-chain tracing gaps.
Funds stolen in a $24 million exploit of the Arbitrum-based platform AFX Trade have been converted from Ethereum into Bitcoin via THORChain, on-chain monitoring shows, reviving a familiar debate over how decentralised cross-chain protocols complicate the tracing of illicit crypto flows.
Security monitoring accounts, including Blockaid, flagged that a wallet linked to the AFX Trade breach swapped 655.4 ETH for 18.86 BTC in a single transaction routed through THORChain. The protocol allows native asset swaps between separate blockchains without the use of wrapped tokens or a centralised exchange intermediary.
A bridge-key compromise, then a cross-chain pivot
AFX Trade was drained of roughly $24 million after its bridge keys were compromised, a breach the protocol has acknowledged through its official channel on X. The subsequent ETH-to-BTC conversion represents only a portion of the stolen funds being repositioned, and does not by itself confirm any laundering outcome or final cash-out.
For investigators, the shift matters because it moves the trail off Ethereum, where the exploit originated, and onto Bitcoin, where a different set of wallet clusters must now be monitored. Analysts note that transactions on both chains remain publicly visible, meaning cross-chain movement adds friction to recovery efforts rather than making funds untraceable outright.
Why regulators keep circling THORChain
THORChain’s design — enabling direct native swaps across chains without routing through a licensed venue — has repeatedly placed it at the centre of post-exploit fund movements tracked by security researchers. That structural feature sits uneasily with anti-money-laundering frameworks built around exchange-level wallet screening, since decentralised routing venues fall largely outside conventional know-your-customer controls.
The AFX Trade case echoes other recent incidents in which stolen funds moved rapidly through cross-chain liquidity pools within hours of a breach, including the Across Protocol relayer attack, which produced under $4 million in net losses with user funds otherwise unaffected. Taken together, these episodes illustrate a recurring pattern: compromised protocols losing funds that are then repositioned across chains before forensic teams can act.
Wider market backdrop for exchange compliance teams
The episode lands against a broader market backdrop that may sharpen scrutiny of exchange-level monitoring. Stablecoin inflows to exchanges have fallen to 2025 lows, while Ethereum spot ETFs recently recorded a $70.6 million outflow, ending a five-day inflow streak — both signals of a market where compliance teams are watching wallet flows closely for signs of stress or illicit activity.
For platforms and custodians, the AFX Trade swap underscores that rapid incident response and wallet screening remain the primary defence once a breach occurs, since transparent blockchains allow near real-time public tracking even when the identity behind a wallet stays unconfirmed. Whether the diverted Bitcoin can ultimately be recovered will depend on follow-on transactions that investigators are now watching on the Bitcoin network.
Read more: Balance Coin’s 99% collapse revives scrutiny of oracle risk in DeFi stablecoins
