THORChain swaps are running again on most of the chains the protocol connects, ending a halt that began on October 31. Within hours, the cross-chain exchange was again carrying funds that blockchain trackers link to the $6.3 billion Binance hack. One bitcoin address received about 66.5 BTC through THORChain between Tuesday evening and early Wednesday UTC, according to the protocol’s own transaction records.
“Swapping on several blockchains has resumed following the 3.21.1 update,” THORChain said on Wednesday. It listed AVAX, Base, Bitcoin Cash, Bitcoin, Dogecoin, Ethereum, Litecoin, RUNE, Tron, XRP Ledger and Zcash as trading. BNB Smart Chain, Cosmos Hub and Solana remain halted.
How the restart happened
The network went quiet after a one-block Ethereum reorganization on October 31. In a November 1 account, THORChain said the reorg left a vault paying out 10 ETH it never received. Its solvency checker stopped ETH swaps, nodes halted ETH signing about two minutes later, and three node votes then halted every chain as a precaution. THORChain said the user had since returned the 10 ETH, and that nodes would re-enable chains “as they are deemed safe.” We covered the original pause and its effect on the Binance laundering route here.
The fix arrived as version 3.21.1, a patch to Bifrost, the component that watches external chains. The release notes describe it as a non-consensus update with no upgrade height. Operators were given a prebuilt binary that carries additional security patches not included in the public source code, and they were told not to build it themselves. Chain activity was to stay paused until at least two-thirds of active nodes ran the new version.
The chains came back in stages. Unchained, citing historical node data, reported that trading returned on Bitcoin Cash, Dogecoin, Litecoin and Zcash at about 16:40 UTC on Tuesday, on Bitcoin at about 17:09 UTC and on Ethereum and Tron at about 19:58 UTC. AVAX, Base and XRP Ledger were already trading again by November 1, according to THORChain.
When THORChain posted its update, 14 active nodes still had not upgraded. A check of THORNode data by AltcoinReporter at about 04:10 UTC on Wednesday showed 101 of 111 active nodes on 3.21.1 and 10 still on 3.21.0. Trading and signing halts remained in place for BNB Smart Chain, Cosmos Hub and Solana, while the network-wide trading halt was off.
Hack-linked funds move again
Lookonchain, using Arkham data, said on Wednesday that the Binance hacker is still converting stolen SOL into BTC. The route it described runs through several steps: split the SOL across wallets, sell it for USDC, bridge the USDC to Ethereum, buy ETH, then swap the ETH for BTC on THORChain. One screenshot it shared shows a 120 ETH swap through the THORChain router at 23:09 UTC on Tuesday, paying out 3.438 BTC.
We checked the bitcoin address in that screenshot against THORChain’s Midgard indexer. It received 31 completed swaps between 20:08 UTC on Tuesday and 03:41 UTC on Wednesday, totaling about 66.5 BTC, worth roughly $5.1 million at current prices. The inputs were about 1,364 ETH and 251,776 AVAX, sent from three Ethereum-style addresses. The AVAX swaps started about three hours after Bitcoin trading came back, even though AVAX itself was never halted. The Bitcoin side of the trade had to reopen first.
The attribution to the hacker comes from Lookonchain and Arkham. AltcoinReporter has not independently confirmed who controls these addresses.
The pressure on node operators
The restart puts THORChain’s node operators back in an awkward spot. The FBI, which attributed the Binance theft to North Korea’s TraderTraitor group, has asked THORNode operators to block transactions linked to the theft. We reported on that alert in our FBI coverage.
Jonty of Pangolin Intelligence said, as quoted by Unchained, that operators voting to reopen trading would be “knowingly doing so,” and said he “wouldn’t vote for that to happen.” On the other side, Barraford, a longtime voice in the THORChain community, said on October 31 that “THORNode operators have zero information that isn’t already public and readily available in real time.”
THORChain itself says there is no one at the wheel. On November 2 it said “there is no single developer or entity in control of THORChain,” pointing to 111 active nodes run by 56 operators. Its halt rules support that point to a degree: three node votes can halt a chain, four can reverse a halt, and five can reverse the reversal. No single operator can open or close trading alone.
RUNE was trading near $0.63 on Wednesday, up about 12% over 24 hours, according to CoinGecko data.
What to watch
The open items are the three halted chains and the last nodes still on the old version. The hacker’s Solana holdings matter most here. While Solana stays halted on THORChain, the SOL has to leave through other venues and bridges before it can reach the ETH-to-BTC leg. A Solana reopening would shorten that route. THORChain also said 3.21.1 brings it “one step closer to launching Monero,” a privacy-coin addition likely to draw attention while the network is under this much scrutiny.
FAQ
Which chains can trade on THORChain now?
AVAX, Base, Bitcoin Cash, Bitcoin, Dogecoin, Ethereum, Litecoin, RUNE, Tron, XRP Ledger and Zcash, according to THORChain. BNB Smart Chain, Cosmos Hub and Solana remain halted.
Why did THORChain halt in the first place?
An October 31 Ethereum reorg led a vault to pay out 10 ETH it never received. Nodes then halted all chains as a precaution. The user later returned the 10 ETH.
Are Binance hack funds using THORChain again?
Lookonchain says yes. THORChain’s records show one address it flagged receiving about 66.5 BTC in swaps after the restart. The attribution comes from Lookonchain and Arkham, not THORChain or law enforcement.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
