THORChain

Simple

THORChain is a network that lets you trade a coin on one blockchain for a coin on another, without an exchange account and without anyone holding your money for you.

It works because the network itself owns pools of real coins on each blockchain it supports. You send it Bitcoin; it takes the Bitcoin into its Bitcoin pool and pays you Ethereum out of its Ethereum pool. Nothing is lent, and no IOU is involved — what arrives is the real coin on the real chain.

About a hundred independent operators run it. Each one has to lock up a large amount of the network's own coin to take part, which they lose if they misbehave, and no single one of them can move the pools' money alone.

What it means for you

Swaps through it take a few minutes, longer from Bitcoin-family chains, because the network waits until it is sure your deposit really happened.

The bigger your trade is compared with the pool you're trading against, the worse the price you get. Large swaps of a thinly traded coin cost noticeably more.

The operators can pause a chain, for example during an upgrade or while something looks wrong. A swap isn't offered while its chain is paused, and a swap that can't be finished is sent back to you, minus fees.

Detailed

Continuous liquidity pools

Every supported asset has a pool holding that asset and the network's own settlement asset, RUNE. There is no Bitcoin-to-Ethereum pool: a swap between them is two trades through RUNE, done in one operation. Pairing everything against one asset means n pools instead of n(n−1)/2, which is what makes supporting many chains practical.

How a deposit becomes a swap

You send your coin to an address the network controls on that chain, with a short instruction attached saying what you want and where to send it. The network's validators each watch the external chains and vote on what they saw; once enough of them agree the deposit happened, the swap executes and the payout is signed and broadcast on the destination chain.

Who controls the money

The addresses holding the pools are controlled jointly by the node operators, so that a large enough subset must cooperate to sign anything and no single operator ever holds a whole key. The set is rotated regularly, which limits what a group that goes bad can do and removes operators who stop behaving.

Economic security

Operators bond the network's own asset to take part, and the bond is slashable. The design holds as long as the total bonded is worth meaningfully more than the pooled assets it secures — if that stopped being true, attacking the network would be cheaper than running it honestly, which is why the protocol actively steers the ratio between bonded and pooled value.

What a swap costs

• The ordinary fee for sending your coin on its own chain.
• A liquidity fee that grows with your trade's size relative to the pool — not a flat percentage.
• An outbound fee covering the destination chain's cost of paying you.

Native assets, and why that matters

There are no wrapped tokens and no bridge receipts: the asset you receive is the real one on its own chain. That removes a whole class of risk, since there is no issuer whose solvency you depend on. The cost is that the network has to hold real coins and watch real chains itself, which is where its complexity lives.

In depth

The slip-based fee

Rather than a fixed percentage, the fee is a function of the trade's size relative to depth. For a pool with asset depth X and rune depth Y, an input x returns

y = (x · X · Y) / (x + X)²

which is the constant-product result with the slip itself charged as the fee. The share taken grows as x/X grows, so a trade at 1% of pool depth pays about 1%, while one at 50% pays far more. Large trades are therefore self-limiting without needing a cap, and splitting a trade over time is a rational response.

Threshold signatures over external chains

The vaults are controlled by a threshold signature scheme: a set of n nodes can produce a valid signature for the address if at least t of them participate, and the full private key exists at no point and in no place. Because the signature is an ordinary one for the destination chain, the chain itself needs no knowledge of the network. Membership is rotated on a schedule — a churn — which bounds the exposure of any one committee and requires a key resharing protocol rather than a key handover.

Consensus about other chains

The hard problem is not signing but observation: the network must agree on facts about blockchains that cannot talk to it. Each validator reports what it has seen at a given external height, and an observation is acted on only once a supermajority agrees. This is why finality on the source chain gates everything: acting on a deposit that is later reorganised away would create an unbacked payout.

The bond-to-pool invariant

If bonded value falls below pooled value, a colluding subset of signers can profitably steal the pools. The protocol responds by moving rewards between bonders and liquidity providers to pull the ratio back, which makes the yield on each side a control signal rather than a fixed rate. It is an unusual property: the network's economic parameters are not set by governance but driven toward a safety condition.

Failure modes and refunds

Three situations are handled by protocol rule rather than discretion: a deposit whose instruction cannot be parsed, a swap whose output would fall below the minimum the sender specified, and a destination chain that is unavailable. All three resolve to a refund on the source chain, less the cost of making it — which is why a failed swap is not free, and why a dust-sized deposit can be consumed entirely by the cost of returning it.