--- title: "THORChain Restores Swaps for Most Chains After Outage Interrupted North Korean Laundering" description: "Node operators voted to reactivate Bitcoin, Ether, and Tron routes following an Ethereum reorg halt, despite warnings of illicit flows." url: https://basisdesk.news/news/thorchain-restarts-swaps-north-korea-laundering-scrutiny published: 2026-11-03T22:26:33.478Z modified: 2026-11-03T22:26:33.478Z section: DeFi author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [BTC, ETH] tags: [thorchain, cross-chain, north-korea, binance-exploit, node-operators, illicit-finance] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # THORChain Restores Swaps for Most Chains After Outage Interrupted North Korean Laundering Node operators voted to reactivate Bitcoin, Ether, and Tron routes following an Ethereum reorg halt, despite warnings of illicit flows. ## At a glance - **What happened:** THORChain nodes reactivated swaps on Nov. 3 for Bitcoin, Ether, and five other assets following an Oct. 31 bug-induced outage. - **Why it matters:** The resumption reopened cross-chain liquidity routes that the FBI and analysts warned would facilitate North Korean laundering of stolen exchange funds. - **Who is affected:** THORChain node operators, cross-chain traders, and centralized exchanges providing liquidity to vault arbitrageurs. - **What's next:** No next step announced - **Primary source:** [THORChain Restarts Most Swaps After Analyst Said Operators Would Expect North Korea to Launder](https://unchainedcrypto.com/thorchain-restarts-most-swaps-after-analyst-said-operators-would-expect-north-korea-to-launder/) — unchainedcrypto.com ## Key points - THORChain nodes resumed trading for Bitcoin, Ether, Tron, and four other networks on Nov. 3 following an Oct. 31 outage [1]. - BNB Smart Chain, Cosmos Hub, and Solana remained suspended as of 3:50 p.m. ET on Nov. 3 [1]. - Pangolin Intelligence warned operators that restarting nodes would knowingly assist North Korea in laundering billions in stolen assets [1]. ## Editorial remark - **Context:** A one-block Ethereum reorganization on Oct. 31 tripped a refund bug in THORChain, freezing activity while North Korean attackers attempted to move billions stolen from Binance. - **Impact:** THORChain validators face heightened regulatory attention after resuming liquidity routes that law enforcement agencies, including the FBI, requested be blocked. - **Watch:** Node governance votes to determine whether and when to reactivate swaps for BNB Smart Chain, Cosmos Hub, and Solana. THORChain node operators reactivated trading for the majority of previously halted blockchains on Nov. 3, according to public node API data [1]. The cross-chain protocol had suspended swaps following a one-block Ethereum reorganization on Oct. 31 that triggered a refund bug, which inadvertently stalled the movement of illicit proceeds stolen from Binance by North Korean state-sponsored hackers [1]. Public THORNode endpoint records indicated that trading resumed for Bitcoin Cash, Dogecoin, Litecoin, and Zcash between 11:36 a.m. and 11:43 a.m. ET on Nov. 3 [1]. Swaps on $BTC were restored around 12:09 p.m. ET, followed by $ETH and Tron at approximately 2:58 p.m. ET [1]. However, BNB Smart Chain, Cosmos Hub, and Solana remained inactive as of 3:50 p.m. ET [1]. Protocol representatives did not issue a formal announcement regarding the resumption [1]. ## Scrutiny Over Illicit Volume The restart occurred despite vocal industry concerns regarding the destination of the protocol's liquidity [1]. Pangolin Intelligence founder Jonty stated in an interview recorded Nov. 2 that operators voting to reactivate the network would be knowingly facilitating the laundering of billions of dollars in stolen capital [1]. He estimated that on days tied to major breaches by TraderTraitor—the FBI's moniker for the North Korean cyber unit tied to attacks on platforms including Bitget, LayerZero, and WazirX—more than 99% of THORChain volume stemmed from actors laundering funds for the regime [1]. Unchained noted that this figure was an estimate without an accompanying dataset [1]. THORChain's decentralized structure has drawn regulatory scrutiny as federal authorities seek to freeze illicit transfers [1]. Co-founder Chad Barraford noted on Oct. 31 that node operators possess only publicly available information, coming as the FBI requested that operators and ecosystem participants blacklist addresses associated with the attackers [1]. Fellow co-founder JP Thor reiterated on Nov. 1 that the full identity set of node operators remains unknown, adding that participants uncomfortable with protocol governance can freely exit [1]. Independent analysts also clarified that flagged deposits into Binance stemmed from intermediary arbitrageurs interacting with THORChain's Asgard vaults, rather than direct deposits from the exploiters [1]. At the time of writing, $BTC traded at $77,725 while $ETH hovered at $2,288. No timeline has been announced for the restoration of BNB Smart Chain, Cosmos Hub, or Solana [1]. ## FAQ **Why did THORChain halt swaps initially?** A one-block Ethereum reorganization on Oct. 31 triggered an internal refund bug, prompting node operators to suspend trading across multiple supported blockchains. **Which chains remain suspended on THORChain?** As of Nov. 3, BNB Smart Chain, Cosmos Hub, and Solana remained halted. ## Sources 1. [THORChain Restarts Most Swaps After Analyst Said Operators Would Expect North Korea to Launder](https://unchainedcrypto.com/thorchain-restarts-most-swaps-after-analyst-said-operators-would-expect-north-korea-to-launder/) — unchainedcrypto.com, 2026-11-03 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai