RU

AML check on THORChain

THORChain is a cross-chain swap network: you send a coin such as BTC to a vault and receive a different native coin, such as ETH, on another blockchain.

Address formatNative accounts start with thor1 · Bech32 with a 6-character checksum; a swap can pay out to an address on another chain (bc1…, 0x…)thor1ze0k3e3jr02kagsdtzrudv6rfy70tawel3skvjExample for illustration, not a real address.
Note

Because a THORChain swap ends on a different blockchain, a check that looks at only one chain may miss where funds came from. Analytics firms have traced large stolen-fund flows through THORChain, including from the Bybit (2025) and Bitget (2026) hacks.

Services that check THORChain

01Merkle ScienceEnterprise platformPrice on requestNot verifiedNot scored

How to check a THORChain address

  1. Get the public addressAsk your counterparty for the address they will send from — or copy it from the incoming transaction.
  2. Pick a service that covers THORChainChoose one marked “Supported” in the list above. If coins you receive came out of a THORChain swap, use a checker that follows cross-chain swaps, not one that only looks at a single blockchain.
  3. Run the check and read itDon't save or reuse a THORChain vault address. The official docs say vault addresses change regularly, so get the current one from the app you use each time.
A real AML check needs only a public address. Never share a seed phrase or private key.

THORChain specifics

  • THORChain describes itself as a decentralized exchange that swaps native coins across blockchains without wrapped assets or bridges.[1]
  • To swap, a user sends coins to a THORChain vault with a short memo that names the coin they want and the destination address, which can be on a different blockchain.[2]
  • Every swap goes through RUNE: the incoming coin is first swapped into RUNE, then RUNE is swapped into the target coin, which the network releases on the destination chain.[3]
  • Vaults are controlled jointly by THORChain's validator nodes using threshold signatures, which need a supermajority of nodes to sign, and each node runs a 'Bifrost' service that watches the other blockchains.[4]
  • Vault addresses change regularly as the node set rotates, so the developer docs warn never to save or reuse a vault address.[5]
  • The FBI attributed the theft of about $1.5 billion in crypto from the exchange Bybit, on or about 21 February 2025, to North Korea ('TraderTraitor') and said some stolen funds had been converted to Bitcoin and spread across thousands of addresses on multiple blockchains. The notice does not name THORChain.[6]
  • TRM Labs reported that the Bybit attackers moved the vast majority of the stolen Ethereum via THORChain, mostly converting it to Bitcoin, and that THORChain saw an unprecedented surge in activity between 24 February and 2 March 2025.[7]
  • Bitget reported unauthorized transfers of approximately $351.6 million from some of its hot wallets, detected at 18:31 UTC on 24 September 2026. Bitget's notice does not mention THORChain.[8]
  • TRM Labs reported that funds from the 24 September 2026 Bitget breach that were on BNB Chain and Ethereum were swapped through THORChain and split across Bitcoin addresses; one flow of about $9.8 million in BNB reached THORChain and was converted to Bitcoin over roughly 13 hours.[9]

Common risks on THORChain

Stolen fundsHighCoins taken in hacks of exchanges, protocols or personal wallets.DeFi protocolLowEstablished on-chain lending, swaps and liquidity pools.

FAQ

What does a THORChain address look like?

Native THORChain accounts start with thor1 (a Bech32-format address with a built-in typo-catching checksum). A swap can also deliver coins to an ordinary address on another chain, such as bc1… for Bitcoin or 0x… for Ethereum.

Is THORChain a bridge or a wrapped-token service?

No. According to its docs, it swaps native coins directly, without wrapped assets or bridges: your coin is swapped into RUNE, then into the target coin, which is released from a vault on the destination chain.

Has THORChain been used to move stolen crypto?

Yes. According to TRM Labs, most of the ETH stolen from Bybit in February 2025 was moved via THORChain into Bitcoin, and some funds from the September 2026 Bitget breach were swapped through THORChain into Bitcoin. That does not mean every THORChain user or transaction is linked to crime.

How do I check a THORChain address for AML risk?

Copy the public address, open one of the services listed above that supports THORChain, and run the check. You never need a seed phrase or private key.

What does “Not verified” mean?

The service claims support somewhere — in marketing copy or a third-party page — but its own docs, pricing or FAQ do not list the network. Treat it as unknown.

Sources

  1. THORChain — THORChain Docs (introduction). Checked 4 Oct 2026.
  2. THORChain (developer docs) — Transaction Memos. Checked 4 Oct 2026.
  3. THORChain — Native Cross-chain Swaps. Checked 4 Oct 2026.
  4. THORChain — Bifrost, TSS and Vaults. Checked 4 Oct 2026.
  5. THORChain (developer docs) — Querying THORChain. Checked 4 Oct 2026.
  6. FBI Internet Crime Complaint Center (IC3) — North Korea Responsible for $1.5 Billion Bybit Hack (26 Feb 2025). Checked 4 Oct 2026.
  7. TRM Labs — Bybit Hack Update: North Korea Moves to Next Stage of Laundering (3 Mar 2025). Checked 4 Oct 2026.
  8. Bitget — [SECURITY NOTICE] Bitget exchange hot wallets Incident — September 24, 2026 (24 Sept 2026). Checked 4 Oct 2026.
  9. TRM Labs — Bitget Loses USD 351.6 Million in Hot Wallet Breach in Likely North Korea Attack (25 Sept 2026). Checked 4 Oct 2026.