THORChain vs Tornado Cash: Which Gets Your Wallet Flagged?

TL;DR - THORChain moved more stolen crypto in ten days than Tornado Cash moved in three years, and almost none of it gets flagged the same way.

Tornado Cash isn't the dangerous one anymore. The dangerous one never got sanctioned at all.

OFAC sanctioned Tornado Cash in August 2022 for laundering more than $7 billion since 2019, including $455 million of the Ronin bridge hack. That case built the public idea of what a crypto laundering tool looks like: a shared pool, a sanctions list, a wallet screen that catches it on contact. THORChain doesn't fit that picture. It's a cross-chain exchange, not a mixer, and it has never been sanctioned by OFAC or any other regulator.

THORChain and Tornado Cash solve two different laundering problems

Tornado Cash is a non-custodial mixer built on zero-knowledge proofs. A depositor sends ETH into a shared pool and withdraws an unlinked note later, often to a brand-new address. The anonymity comes from the pool itself: with enough other depositors, the input and the output can't be matched on-chain.

THORChain is a cross-chain decentralized exchange. There's no shared pool and no proof system. A user deposits ETH, THORChain's vaults swap it for BTC (or another asset) through automated market makers, and the BTC comes out on a completely different chain. The link doesn't break because funds got mixed with anyone else's. It breaks because the asset and the chain both changed at once.

Both started as legitimate infrastructure before their criminal use became the headline. Tornado Cash launched in 2019 and carried billions in ordinary DeFi volume before OFAC's 2022 designation made deposit-and-forget privacy radioactive for anyone touching a regulated exchange. THORChain launched in 2021 as a decentralized network for swapping native assets without wrapping them, and most of its volume is still routine cross-chain trading - it just also happens to be the fastest way to turn stolen ETH into untraceable BTC.

Different tool. Same blind spot.

Head-to-head

The Bybit hack moved $1 billion through THORChain in ten days

On February 21, 2025, Lazarus Group-linked hackers drained roughly $1.4 billion from Bybit, the largest crypto theft on record. The FBI publicly attributed the theft to North Korea within days, consistent with the group's pattern across more than $2 billion in crypto thefts since 2017. Within ten days of the Bybit hack, the attackers had moved about 83% of the stolen ETH - near $1 billion - through THORChain, converting it to Bitcoin and spreading it across 6,954 wallets. THORChain's validators earned $5.5 million in swap fees from that volume alone.

THORChain didn't block a cent.

It wasn't a one-off. In April 2026, the exploiter behind a $292 million LayerZero-bridge drain at Kelp DAO laundered roughly $80 million of it the same way - ETH to BTC, through THORChain. The protocol's swap volume spiked to $394 million in 24 hours, against a normal range of $10-35 million. Anyone watching THORChain's own dashboard could see that spike in real time. No swap was stopped, and none was reversed.

Does wallet screening actually catch a THORChain hop?

A direct deposit into Tornado Cash is one of the easier things for a wallet screen to catch. The contract address is public and has sat on every major sanctions and mixer blocklist since 2022. A THORChain swap is harder to resolve. The Ethereum-side deposit touches a known THORChain vault, which a screen can label - but the Bitcoin-side withdrawal lands on a different address on a different chain, and connecting the two by hand usually means cross-referencing a block explorer like Etherscan on one end and mempool.space on the other, matching amounts and timing yourself.

Rather than chasing two explorers across two chains, screen the address with Plastron to see sanctions, mixer, and stolen-funds exposure across Ethereum and six other chains at once.

A screen that flags direct contact with a sanctioned address catches a Tornado Cash deposit the moment it happens - Plastron's own corpus carries 780 OFAC-listed addresses and 28 wallets tagged as mixer infrastructure, out of 3,902 labeled wallets total. A THORChain deposit sits on none of those lists, so it clears that exact check. What should flag it instead isn't the destination - it's the pattern: a large swap into a cross-chain vault right after funds moved out of a hacked contract or a blacklisted source.

Verdict

THORChain is the bigger blind spot for anyone screening wallets for stolen-fund exposure today. It carries no sanctions listing, no blocked-contract flag, and - as the Bybit and Kelp DAO cases show - no willingness to stop even a nine-figure laundering run while it's happening.

Tornado Cash still wins on one count. Once funds clear its anonymity pool, the on-chain link is actually broken - not just moved to a different chain where someone else can still trace it. A THORChain swap only hides the asset and the chain; an analyst with enough patience can still correlate the ETH leg and the BTC leg by amount and timing, which is exactly how the Bybit and Kelp DAO flows got traced back to their source in the first place. If genuine unlinkability is the goal, Tornado Cash's cryptography still does more of that job than THORChain's AMM ever will.

For a compliance team, that means treating a large inbound swap from a cross-chain vault the same way a direct mixer deposit gets treated - not because the mechanism is identical, but because the destination information it erases is just as complete.

Different problem, not a smaller one.