Chainflip to prevent the illegal flow of Bybit hacker funds through protocol upgrades

Chainflip has announced its decision to block the illegal movement of funds linked to the Bybit hack within its protocol through an upgraded 1.7.10 screening tool. The firm acknowledged that the majority of the necessary code had been written and was in the testing phase.

Chainflip also revealed that the upgraded version is expected to be deployed on the network within the next 24 to 72 hours. The firm made the decision after discussions with its team, community, liquidity providers, primary interfaces using Chainflip, and most validator providers.

Chainflip opts for protocol upgrades to prevent flow of Bybit hacker funds

Update:
We’re working closely with @THORChain, @Chainflip, and @elliptic to ensure that the @Bybit_Web3 hackers’ funds don’t move through their networks using @RangoExchange.

Since Thorchain and Chainflip are decentralized networks, adding screening features isn’t… https://t.co/S9LNXFWRek

— VK | Rango (@TheVaKa_) February 24, 2025

Chainflip Labs revealed that they were moving forward with their plan to enable interfaces to robustly block illicit flows of hacker funds in its protocol. The firm argued that elicit flows endanger the protocol by exposing LPs to too much risk. Chainflip also stated that the broad and overwhelming consensus amongst its ecosystem was to see the interests of normal users protected.

The cross-chain bridge acted quickly to cut off access to its main interface after flows from the Bybit hack were spotted on Saturday morning. The firm has also been working with other providers to ensure that no illicit flows touched the protocol since February 22.

“With 150 validator slots and dozens of liquidity providers, Chainflip remains one of the largest decentralized cross-chain services in the space, and none of our network participants have any interest in supporting criminal activity.”

~ Chainflip Labs.

Chainflip stated that brokers can use the 1.7.10 screening tool, which is an upgrade to the existing broker-level screening tools, to reject incoming BTC deposits if they detect a high-risk transaction. Any rejected high-risk deposits will be sent back directly to the refund address specified by the user. The firm argued that the feature was already extended to Ethereum and all ERC20 tokens.

The protocol acknowledged that the screening could be evaded by setting up a new one since anyone can create a broker. Chainflip also noted that not all brokers currently have access to advanced screening tools that would allow them to automatically detect high-risk flows. The firm has partnered with SwapKitPowered and Rango Exchange to mitigate the risks. According to Chainflip Labs, both companies will be granted the ability to reject any deposits to the network facilitated by any broker.

Chainflip’s upgrade implicates its protocol and LPs

Chainflip highlighted that working closely with Elliptic, Chainalysis, Bybit API, and other investigators will form robust and permanent protection for LPs on its network. The firm also maintained that moving forward, its protocol will not be useful to anyone whose wallet can be linked to any major incident, hack, fraud, or scam. Chainflip argued that it would allow the protocol to provide a more reliable and secure environment for LPs to commit more capital with lower risk. The firm also added that the upgrade will improve services to DeFi users everywhere.

Chainflip also mentioned that it will open up access to swap.chainflip.io again after the new upgrade goes live in 24 to 72 hours. Opening up access to its network will encourage the remaining LPs who have pulled back liquidity to start providing quotes again.

The firm also addressed the criticism based on its response to putting one of its platform’s interfaces into maintenance mode and claimed that “we do not need regulators to tell us what to do in this situation.” The firm argued that its participants decided to pause the interface to protect the network against exposure and involvement with the largest heist in history. 

The decentralized protocol stated that making Chainflip a safe space for LPs to play without risk of exposure to illicit flows will strengthen pricing and liquidity over time. The firm also added that it would improve its competitiveness with centralized exchanges and other DeFi operators alike. The TSS-based protocol said it plans to inspire other DeFi protocols that could be taking similar steps to “cut the cancer of crime out of the industry.”

Chainflip also had a message for the Lazarus Group that hacked Bybit: “Take your stolen money elsewhere—we don’t want it.”

Cryptopolitan Academy: Tired of market swings? Learn how DeFi can help you build steady passive income. Register Now