Arkham identified ThorChain as the primary laundering channel for North Korea's Lazarus Group, following a $292 million rsETH exploit. The incident has solidified market expectations for further large-scale crypto hacks this year.
The exploit involved minting $292 million in unbacked rsETH, which was then used to borrow $236 million across various protocols, resulting in approximately $200 million in bad debt. The stolen funds were laundered through ThorChain, decentralized exchanges, and non-KYC services.
This marks the latest instance of ThorChain being used by state-sponsored actors, prompting scrutiny of cross-chain swap protocols that lack identity verification. In response, KelpDAO paused rsETH contracts, and Aave launched a "DeFi United" initiative, measures considered by traders to be insufficient to prevent future breaches.