THORChain review
THORChain is a cross-chain exchange protocol for native assets such as Bitcoin, Ethereum and Zcash, and no single company runs it. There is no account, and the official interface says it will never ask for a picture ID, phone number or home address. The terms of the interface exclude sanctioned jurisdictions and those identified by the FATF for weak anti-money-laundering controls. In May 2026, an exploit resulted in approximately $10.7M being drained from one vault, leading to the network being offline for about five weeks. In our view, THORChain suits self-custody users who accept that halts can stop every swap.
No ID, by design
THORChain never asks for ID by design, per its own pages.
Choose THORChain if
Who THORChain suits, from the values on this page.
THORChain suits you if
- You want to trade with no account and no ID: THORChain never asks for ID, by design.
- You want open-source software.
THORChain might not be the right fit if
- You want Lightning: THORChain does not support it.
- You want shielded Zcash: THORChain accepts transparent addresses only.
- You want a service with no incident on record: THORChain had one in 2026.
Inside THORChain
Screenshots taken November 3, 2026
What you get with THORChain
Yes, no or partly, from our dataPrivacy 2 of 6
- No IDYesBy design
- No accountYes
- Tor built inNot statedNot statedTHORChain's own pages we checked do not say. This is not the same as no.
- Onion addressNoNone published
- I2P addressNoNone published
- Works without JavaScriptNo
Coins 1 of 4, 1 partly
- BitcoinYes
- MoneroNot statedNot statedTHORChain's own pages we checked do not say, checked Oct 22, 2026. This is not the same as no.
- LightningNo
- ZcashPartlyTransparent addresses only
Custody and code 1 of 3
- You hold the keysNo
- Open sourceYes
- Address screeningNot statedNot statedTHORChain's own pages we checked do not say, checked Oct 14, 2026. This is not the same as no.
When can THORChain ask for your ID?
Never, by design, per THORChain's own pages. Labels come from each provider's terms, never from our guess.
- 1Never, by designTHORChain is on this stepNo company holds your order, so nobody can ask
- 2Only if you chooseID only for extras you opt into
- 3If a payment is flaggedNo ID by default; checks when a risk system flags you
- 4Above a limitID once you pass a stated amount
- 5AlwaysID before you trade, deposit or withdraw
If a check comes and you do not pass it
No KYC hold exists. Network-wide halts by node operators can stop trading and signing for all users (e.g. May 15 to June 22, 2026 after an exploit).
“node operators brought the entire network to a full stop shortly after via manual pauses and governance votes”
Not stated on THORChain's pages: what triggers a check, fee on refusal, refund policyTHORChain's own pages we checked do not say, checked Oct 14, 2026. This is not the same as no.
Checked October 22, 2026
What THORChain costs
| What | THORChain |
|---|---|
| Trade fee | Inbound network fee (paid by the sending wallet), liquidity fee (slip-based, with a minimum in basis points per asset class), outbound fee on the destination chain, and an optional affiliate fee added by the interface. swap.thorchain.org adds no fee of its own. |
| No-ID limit | Not statedTHORChain's own pages we checked do not say, checked Oct 14, 2026. This is not the same as no. |
What THORChain knows about you
Who sees what during a trade, and who runs it.
During a trade
No ID check does not make a bank payment private.
Network and who runs it
- Warrant canary
- Not published
Checked October 22, 2026
Track record and code
4 items found; THORChain post-mortems used where available, Bybit item from press.
Incidents
- 2026May 15, 2026: A newly joined node operator exploited a GG20 TSS vulnerability and drained about $10.7M from one of five vaults; network halted until June 22, 2026; financial recovery under ADR-028 still unresolved per the Q2 2026 report.
- 2025Feb 2025: Proceeds of the Bybit hack (attributed to Lazarus) were swapped through THORChain; a node vote to halt was reversed and a developer left (press reports).
- 2025Jan 24, 2025: THORFi Savers and Lending withdrawals paused by node vote with about $200M outstanding liabilities; programs later unwound.
- 2021Jul 2021: Two exploits of the ETH router (first took about 4,200 ETH); THORChain treasury to cover liquidity provider losses. Post-mortem published 2021-07-30.
Checked October 22, 2026
Community
Discussions about THORChain on Reddit (opens in a new tab) (r/THORChain)
More facts we checked on THORChain
- Onion address
- Not published
- I2P address
- Not published
THORChain in the US and elsewhere
In the US
US availability: Available
If you are a US person, US sanctions rules apply to you whether or not a service asks for ID.
Outside the US
Where THORChain does not serve
3 places in its terms- Jurisdictions identified by the Financial Action Task Force (FATF) as having strategic deficiencies in anti-money laundering (AML) or counter-terrorist financing (CTF) measures
- Jurisdictions subject to comprehensive sanctions programs
- Any jurisdiction where offering, accessing, or using the Services would violate applicable law
Regional rule: Not statedTHORChain's own pages we checked do not say. This is not the same as no.
- Site blocks by region
- Jurisdictions identified by the Financial Action Task Force (FATF) as having strategic deficiencies in anti-money laundering (AML) or counter-terrorist financing (CTF) measures; Jurisdictions subject to comprehensive sanctions programs; Any jurisdiction where offering, accessing, or using the Services would violate applicable law
Where you live and the provider's terms
Many services on this page do not serve every country. Some exclude people because of where they live or their citizenship, not only where they connect from. Read the provider's terms before you send funds. If the terms exclude you, do not use the service, and do not try to get around the restriction, for example with a VPN.
Taxes
A service that does not ask for ID does not change your taxes. In the US, the federal income tax return asks a yes-or-no question about digital assets, and you must report digital asset transactions whether or not they result in a gain or loss. In the UK, you may owe Capital Gains Tax when you sell, swap or spend crypto, and you must keep your own records. Rules in other countries differ.
No KYC is not anonymity
"No KYC" here means the provider says it does not ask for ID in the cases its terms describe. It does not make you anonymous. The provider's terms may let it ask for ID later. Regulated exchanges you send funds from or to may have to collect information about who sends and who receives a crypto transfer. Your tax duties stay the same.
Funds can be held
If a provider asks for more information during a swap or a withdrawal, it may hold your funds until it gets it. Its terms decide what happens next. In the UK, a crypto business that asks for information on a transfer to or from a self-custody wallet, and does not receive it, must not pass the funds on. Read what the provider's terms say before you send. THORChain's terms say that if a check is requested and not completed: no KYC hold exists. Network-wide halts by node operators can stop trading and signing for all users (e.g. May 15 to June 22, 2026 after an exploit).
Checked October 22, 2026
DEX and cross-chain to compare with THORChain
Other active services in this category from our list. The shield shows each one's ID rule from its own terms.
THORChain side by side
From our privacy data, the same fields for every service| What | THORChain | Jupiter (jup.ag) | Maya Protocol (MAYAChain) | Uniswap (Uniswap Labs interface) | 1inch | Chainflip |
|---|---|---|---|---|---|---|
| ID rule | No ID, by design | No ID, by design | No ID, by design | No ID, by design | ID only if flagged | ID only if flagged |
| Account | None | None | None | None | None | None |
| You hold the keys | No | Yes | No | Yes | Yes | No |
| Monero | Not stated | No | No | No | No | No |
| Lightning | No | No | No | No | No | No |
| Open source | Yes | Yes | Yes | Yes | Yes | Yes |
Checked October 23, 2026
Short answers about THORChain
From the data on this page.
Does THORChain ask for ID?
THORChain never asks for ID by design, per its own pages. There is no account.
Who holds your coins during a THORChain trade?
Held during the swap. Non-custodial for users (self-custody wallets); assets in transit and pool liquidity sit in protocol vaults whose keys are split among node operators by threshold signatures (TSS)..
What does THORChain cost?
Trade fee: Inbound network fee (paid by the sending wallet), liquidity fee (slip-based, with a minimum in basis points per asset class), outbound fee on the destination chain, and an optional affiliate fee added by the interface. swap.thorchain.org adds no fee of its own..
Who checked this page
Sources, how we read the terms and our process
Sources
- blog.thorchain.org/post-mortem-eth-router-exploits-1-2-and-premature-return-to-trading-incident, for incidents, checked October 22, 2026
- blog.thorchain.org/thorchain-exploit-report-1, for custody, custody in detail and incidents, checked October 22, 2026
- blog.thorchain.org/thorchain-quarterly-report-q2-2026, for status and what happens if a check fails, checked October 22, 2026
- blog.thorchain.org/thorfi-unwind, for incidents, checked October 22, 2026
- dev.thorchain.org/chain-clients/utxo.html, for Zcash address type, checked October 22, 2026
- forklog.com/en/thorchain-developer-departs-amid-bybit-asset-laundering-scandal, for incidents, checked October 22, 2026
- swap.thorchain.org, for Monero and open source, checked October 22, 2026
- swap.thorchain.org, for JavaScript, checked October 23, 2026
- thorchain.org, for account, Monero, Lightning, onion address, I2P address and US availability, checked October 22, 2026
- thorchain.org/faq, for Zcash and bitcoin, checked October 22, 2026
- thorchain.org/pricing, for fees, checked October 22, 2026
- thorchain.org/privacy-policy, for data collected, checked October 22, 2026
- thorchain.org/terms-of-use, for ID rule, operator, excluded countries, warrant canary and site blocks by region, checked October 22, 2026
How we read the terms
We do not give privacy services a score. We record what each provider's own pages say: when it asks for ID, the limits, who holds your coins and what it costs. Labels come from each provider's terms, never from our guess. How we read the terms
Our process
We take fees, availability, licenses and coin counts from primary sources: THORChain's own fee schedules, terms and help pages, and the public registers kept by regulators. Every value carries the date we last checked it. The values on this page were checked between October 22, 2026 and October 23, 2026.
Not legal or tax advice. This page explains how these services work and what their own terms say. It is general information, not legal, tax or financial advice. Rules differ by country and change often. Check the rules where you live, or ask a qualified professional, before you use any service listed here.