More than 90% of funds exchanged through THORChain were linked to illicit or gray-market activity, according to on-chain analyst Ember. Ember said most funds stolen from Bybit last year moved through the protocol, which collected nearly $10 million in fees over 10 days. Some funds stolen from Bitget recently also moved through THORChain, with related fees reaching $1 million.