THORChain Restores Most Swaps Despite Money Laundering Allegations

THORChain has resumed token swaps on the majority of its supported blockchains following a multi-day halt, despite allegations from blockchain analysts that the decentralized protocol is actively used by North Korean hackers to launder stolen funds ².

The cross-chain liquidity network initially paused operations on Oct. 31 after a one-block Ethereum reorganization triggered a refund bug, affecting 12 chains ²³. The outage temporarily halted North Korean hackers from moving funds recently stolen from the cryptocurrency exchange Binance ². THORChain Restores Swaps for Most Chains After Outage Interrupted North Korean Laundering

Reorg Triggers Multi-Chain Halt and Restart

The service interruption began on Oct. 31 due to an Ethereum ($ETH) reorganization that caused a refund error within the protocol ³. While outbound signing remained enabled on most affected chains to allow existing payments to process, new swaps were entirely blocked ³.

Network data indicated that recovery began on Nov. 3 ². Between 11:36 a.m. and 11:43 a.m. ET, trading was restored for Bitcoin Cash, Dogecoin ($DOGE), Litecoin, and Zcash ². Bitcoin ($BTC) swaps followed at approximately 12:09 p.m. ET, while Ethereum and Tron swaps were functional by 2:58 p.m. ET ².

Despite the broader recovery, trading and outbound-signing restrictions remain in place for BNB Smart Chain ($BNB), Cosmos Hub, and Solana ($SOL) ¹. According to node data, Cosmos Hub and Solana had been halted prior to the Ethereum reorganization event ². As of the latest data, 14 node operators had not yet upgraded their software to support the restart ¹.

Laundering Allegations and Node Operator Decisions

The restart has drawn scrutiny from blockchain intelligence analysts regarding the protocol's use by illicit actors. Jonty, founder of Pangolin Intelligence, stated on Nov. 2 that any node operator voting to reactivate THORChain would do so "knowingly" expecting North Korea to use the network to launder billions of dollars in stolen assets ².

Jonty estimated that on the days of major hacks attributed to the FBI-designated North Korean group "TraderTraitor"—including incidents involving Bitget, LayerZero, and WazirX—more than 99% of THORChain's volume consisted of "people laundering money on behalf of North Korea" ². The analyst did not cite a specific dataset to support this figure ².

Separately, Jonty disputed a since-deleted claim by blockchain analytics firm Arkham that the Binance hacker was directly depositing funds back into Binance ². He clarified that Arkham had traced the funds through THORChain's Asgard vaults to arbitrage traders, many of whom use Binance for liquidity ². Onchain analyst SomaXBT corroborated this, noting that the deposits flagged by Arkham were paid by THORChain accounts rather than the hacker directly ².

Implications for Decentralized Infrastructure

The event highlights the tension between permissionless infrastructure and illicit finance. In response to the scrutiny, THORChain's official accounts emphasized the network's decentralized governance. A Nov. 2 post stated that "there is no single developer or entity in control of THORChain" ².

Co-founder Chad Barraford noted on Oct. 31 that THORNode operators possess "zero information that isn't already public and readily available in real time" ². This statement followed requests from the FBI for node operators to block specific addresses associated with hackers ². Fellow co-founder JP Thor added that uncomfortable node operators are free to leave the network, noting that the identities of the full set of operators remain unknown ².

What to Watch

Market participants are monitoring the status of the remaining halted chains, specifically BNB Smart Chain, Cosmos Hub, and Solana ¹. THORChain has not provided a timeline for when these networks will resume normal operations ². The protocol's governance relies on the remaining 14 nodes upgrading to fully process the network restart ¹. Additionally, scrutiny may intensify on liquidity providers and arbitrageurs who route funds between THORChain's Asgard vaults and centralized exchanges like Binance ².