Mentioned in This Article
1. THORChain restart brings most chains back online
THORChain, the cross-chain swap protocol, had resumed trading on most of the networks it paused after an Ethereum reorganization on October 31, according to data from its public nodes read at 3:50 p.m. ET on November 3. The THORChain restart covered Bitcoin, Ether and Tron swaps, while three chains stayed halted and the project had made no announcement about reopening them.
The pause began when a one-block reorg triggered a bug in the way the protocol issues refunds. It also slowed North Korean hackers who were trying to move funds stolen from Binance, a theft the sources describe as worth $6.3 billion. The timing of the restart has now put node operators at the center of an argument about who is responsible for what flows through a network that has no single owner.
THORChain lets users exchange native assets across separate blockchains without wrapping them or relying on a central custodian. Swaps are processed by a set of independent node operators who collectively hold the pooled funds and run the software that approves each trade. Because those operators also vote on protocol changes, a decision to reopen halted chains is not made by a company but by the people running the nodes.
2. Which chains are running again?
The node data shows a staggered recovery. Bitcoin Cash, Dogecoin, Litecoin and Zcash resumed between about 11:36 a.m. and 11:43 a.m. ET on November 3. Bitcoin followed at around 12:09 p.m. ET, and Ethereum and Tron came back at around 2:58 p.m. ET.
These times come from the inbound addresses endpoint of THORChain's public node interface, which lists the chains currently accepting deposits. The figures were read at past block heights, so they reflect when the network's own records changed rather than any statement from the project.
As of 3:50 p.m. ET, BNB Smart Chain, Cosmos Hub and Solana were still halted. Node data indicated that Cosmos Hub and Solana had been halted since before the Ethereum reorg. No explanation was given for why the three remained off, and no reopening date had been published. THORChain had not announced the restart of the other chains either; the evidence for it is the node data alone.
For traders, the practical meaning is that the most heavily used routes on the network, those involving Bitcoin and Ether, are available again, while smaller or less liquid routes remain closed. Anyone relying on the remaining three chains for cross-chain transfers must still look elsewhere until the node data shows deposits being accepted again.
3. What caused the THORChain halt?
The trigger was an Ethereum reorg on October 31. A reorg happens when a blockchain replaces one or more recently confirmed blocks with a different version of the chain. In this case the reorg was one block deep, a small event by the standards of public networks, but it exposed a refund bug in THORChain that led to the pause.
Protocols that accept deposits on external chains rely on those chains' records being stable. When a block that contained a deposit is replaced, the protocol can end up crediting or refunding funds based on information that is no longer valid. Halting trading while the problem is understood is a common defensive response.
At the time of the pause, 10 chains were halted. By the afternoon of November 3 that number had fallen to three, based on the node data.
The same episode also delayed North Korean hackers moving the funds stolen from Binance. That detail is why a routine bug fix became a matter of wider interest: every hour the swap routes stayed closed was an hour in which one of the most convenient ways of converting stolen assets across chains was unavailable to the thieves.
4. What did the analyst say about North Korea?
Jonty, the founder of Pangolin Intelligence, who posts as tanuki42, discussed the situation on a podcast episode recorded on November 2, while the 10 chains were still halted. He said that restarting THORChain would require node operators to vote on a protocol upgrade that turns the chains back on.
In his view, an operator who votes yes would be acting knowingly. He said such a person would be expecting North Korea to launder what he called "literally like billions of dollars" through the system. He added that he would not vote for that outcome.
The remarks put a moral frame on what is otherwise a technical decision. The comments came before the restart, and the node data show that the chains began returning the following day, so the operators ultimately acted in the direction he had warned against. Jonty's statement should be read as his own assessment, not a finding by any authority.
5. How does THORChain say decisions are made?
THORChain's official account addressed the question in two posts. On November 1, it said nodes would decide when chains are safe to re-enable. On November 2, it said that no single developer or entity controls THORChain.
The co-founders spoke in similar terms. Chad Barraford said on October 31 that THORNode operators have no information beyond what is public and available in real time. He made the remark after the FBI asked operators and others to block addresses linked to the hackers.
Another co-founder, JP Thor, said on November 1 that operators who feel uncomfortable can leave and others can join. He added that nobody knows the full set of THORNodes. Together, the statements describe a network in which responsibility is deliberately distributed, and in which the people running the software see themselves as individual participants rather than as an organization taking instructions.
This structure explains why no single announcement accompanied the restart. If the decision rests with individual operators acting on public information, there is no spokesperson who can speak for all of them, and the first evidence of a decision is the change in the network's own records rather than a press release.
6. Where do the Binance deposits fit in?
A separate argument concerned whether the stolen funds had been deposited at Binance itself. Jonty disputed a November 2 post from the blockchain analytics firm Arkham that said the Binance hacker had deposited to Binance. Arkham has since deleted that post.
According to Jonty, Arkham had traced funds through THORChain's Asgard vaults, the pooled wallets that hold assets for the protocol, to arbitrageurs, many of whom use Binance for liquidity. He called it a mischaracterization to say the funds were laundered through Binance directly.
The onchain analyst SomaXBT made the same point. The analyst said the flagged address was the THORChain Asgard vault and that the deposits to Binance were paid by THORChain accounts. The distinction matters because it separates two claims: that stolen money passed through THORChain, and that Binance knowingly received it from the thief.
Arkham is a blockchain analytics company whose public labels are widely used by traders and journalists to follow large transfers. The deletion of its post does not settle where every stolen coin ended up, but it removes one specific claim from the discussion, and it leaves the analysts' account of the route through the vaults and arbitrageurs as the version still standing.
7. What role does Binance liquidity play?
Jonty said it is an open question whether Binance will keep supplying liquidity to the protocol, and he expects the issue is being debated inside the exchange. Arbitrageurs who keep THORChain's prices aligned with the wider market often depend on large venues, so a change in a major exchange's posture could affect how well the protocol functions.
He did not say that Binance had decided anything. His comment was a description of a decision that he thought the company would have to consider, given that its own customers' funds were the ones stolen.
The concern is practical as much as ethical. A protocol that depends on outside liquidity can be slowed by a single large participant stepping back, and that dependence gives exchanges a degree of indirect influence over a system that describes itself as having no central controller.
8. How much of THORChain's volume is laundering?
Jonty offered an estimate of the scale. On days of major hacks attributed to TraderTraitor, the name the FBI uses for the North Korean group, he said 99 percent or more of THORChain's trading volume was North Korean laundering. He named Bitget, LayerZero and WazirX among the incidents.
The number is his own estimate. He did not cite a dataset for it, and none was identified that measures the share. He said he did not know the all-time proportion but assumed it was still a majority. Readers should treat the figure as an informed opinion rather than a measured statistic.
Even as an estimate, the claim illustrates why the debate has become so heated. If a large share of a protocol's activity on certain days comes from a sanctioned or criminal actor, the question of whether to keep it running becomes difficult to separate from the question of whether it should exist in its current form.
9. What to watch next
The immediate question is what happens to BNB Smart Chain, Cosmos Hub and Solana. THORChain's November 1 post gave no date for reopening the chains that remained halted, and none had been announced when the node data was read. Any change should appear first in the node interface and then, possibly, in a statement from the project.
The larger question is whether the FBI's request, the criticism from analysts and the scrutiny of Binance's liquidity lead operators to change how they handle flagged addresses. For now, the network has shown that its operators can restart trading without any formal announcement, and that the people who run it describe themselves as independent actors rather than as a body that answers to anyone.