THORChain fees surge 217 percent without Bitget exploit revenue

• October 5-11 fees of $404,600 represent 217% growth versus the prior baseline week, excluding exploit-related volume
• September’s $3.01 million in system income was driven 63% by a five-day window tied to Bitget hacking activity, which THORChain refused to freeze
• Active wallets reached 25,000 in September, a three-month high, while Protocol-Owned Liquidity attracted 946,450 RUNE in its first full month

• $404,600 THORChain weekly fees versus $191,500 in pre-surge baseline week
• $1.9M of $3.01M September income from five-day exploit window, versus $1.1M from regular activity
• 946,450 RUNE deposited into POL in first full month, worth $679,120

THORChain’s September State of the Network report shows the cross-chain liquidity protocol has moved past a volatile month shaped by external events and returned to steady, higher-baseline operations. The week ending October 11 generated $404,608 in fees according to DeFiLlama, up from approximately $191,500 in the week before the September 25, October 1 exploit surge. That earlier week was the network’s normal state; the surge itself came from roughly $1.37 billion in swaps tied to the $387.5 million Bitget breach, which accounted for 57-63 percent of September’s total volume and nearly two-thirds of monthly fee income. With that flow gone in October, THORChain’s sustainable fee baseline has more than doubled versus its pre-spike level, indicating genuine network growth independent of the security incident.

THORChain refuses to freeze Bitget attacker’s funds, citing lack of admin controls

When Bitget CEO Gracy Chen made a public appeal on September 26 for THORChain to block the attacker’s wallets, the protocol declined. Circle and Tether had already frozen approximately $318,000 in stablecoins tied to the hack on September 25, but THORChain’s architecture offers no mechanism to do so at the application layer.

The network has no admin key or controlling multisig, and its emergency halt is designed as a network-wide security feature, not a tool for freezing individual addresses. THORChain had also declined to blacklist wallets following its own $10.7 million vault exploit earlier in 2026, maintaining consistency with its governance model.

For institutional users and custody solutions, this immutability is both a structural constraint and a stated feature. The refusal to freeze Bitget funds meant that approximately $1.9 million in fees, nearly two-thirds of September’s total network income, flowed to node operators and liquidity providers even though the source was criminal proceeds.

While this position aligns with THORChain’s decentralized design, it highlights a fault line between cross-chain protocols and stablecoin issuers, who retain unilateral freezing power at the settlement layer.

POL expands to 946,450 RUNE while RUNE burn share shrinks to 1 percent

THORChain’s Protocol-Owned Liquidity initiative, which captures system income into protocol-controlled pools rather than distributing it entirely to node operators, completed its first full month with 946,450 RUNE deposited and $679,120 in deployed position value. The initiative accumulated most of its capital on the two heaviest fee days, September 10 and the late-month exploit window, and now sits in three pools: XRP ($226,400), USDT on TRON ($107,300), and TRX ($5,800), with 427,700 RUNE held out of circulation. POL has already earned an estimated $113,250 in fees, making it a material source of network revenue.

Concurrent with POL’s growth, node operators voted to cut the RUNE burn share from 5 percent to 1 percent of system income, redirecting the 20 percent share that previously went to node operators toward POL deposits instead.

The change reduces direct token deflation, September’s burn fell to 94,000 RUNE despite system income rising nearly fivefold to $3.01 million, but places more capital under protocol control. This shift reflects a tradeoff between reducing ongoing supply inflation and concentrating liquidity management authority in the protocol itself, which governance has chosen in favor of the latter.

Fee composition and affiliate revenue show Ethereum dominance outside the exploit window

Ethereum generated the largest slice of October 5-11 fees at $129,183, followed by THORChain’s native chain at $95,516, Bitcoin at $74,517, and TRON at $64,747. This pattern mirrors most of September outside the exploit window, when Ethereum, Bitcoin, and RUNE typically drove $10,000 to $70,000 in daily fees.

The late-month exception came on September 26, when XRPL brought in $501,000 of roughly $869,000 in total fees, ahead of Bitcoin at $217,000 and Ethereum at $85,000, reflecting the specific routing patterns of the Bitget attacker’s fund movements rather than new user demand.

Affiliate volume earnings reached $840,700 in September, up from $250,000 in August and the highest monthly total since January’s $1.03 million.

Most flowed to unlabeled affiliates at $669,000, but among named frontends, TrustWallet led at $56,500, followed by Edge Wallet at $25,600 and THORSwap at $18,900. swap.thorchain.org dominated the September volume board with $163.85 million across 3,240 swaps, and the protocol has now onboarded Edge Wallet and Symbiosis into a dynamic fee model, pioneered by ShapeShift, where minimum fees adjust daily per trading pair based on revenue rather than applying a network-wide 10 basis point floor.

Active nodes grow to 103 while active wallets stabilize at 25,000

The active validator set expanded from 87 to 103 nodes in September, with total bonded capital reaching 97.66 million RUNE ($77.39 million) up from 83.47 million in August. The latest churn brought the Zcash chain online, and the next scheduled churn will add a net 2 million RUNE in bonded capital.

Despite the surge in swap volume in late September, active wallets barely moved, staying at 25,000 after climbing from 23,500 in August, the third consecutive month of growth and the highest level since April.

The stability suggests the exploit-related volume came from a small number of large flows rather than new retail adoption, a positive signal for infrastructure planning but a caution against overestimating user growth from single-week anomalies.

First reported by Cryptopolitan, the data has been independently confirmed against DeFiLlama’s seven-day fee tracker.

The CCS read. We view THORChain’s refusal to freeze addresses and its architectural inability to do so as a competitive advantage for traders seeking censorship resistance, but a liability for regulated custodians and stablecoin-based settlement flows. The network’s real fee growth sits at roughly double its pre-September level; the sustainable question is whether the three-month wallet growth trend holds as the protocol competes for volume against Uniswap and centralized venues where regulatory compliance is built in.

Watch whether the active node set and bonded RUNE capital continue to grow into Q4 without major security incidents, and whether the dynamic fee model’s adoption beyond ShapeShift and Edge Wallet, now live at 2.66 basis points average, drives material volume away from the flat 10 basis point tier. The next validator churn, scheduled but undated in the report, will test whether the network can scale validator capacity without compromising bond economics.