THORChain restored swaps for most of the chains that were halted after an Oct. 31 Ethereum reorg triggered a refund bug, according to the network’s own THORNode data reviewed at 3:50 p.m. ET on Nov. 3.
Unchained reported on Nov. 2 that the halt also blocked North Korean hackers from moving funds stolen from Binance.
Chains that resumed and those still halted
Data from the /inbound_addresses endpoint of THORChain’s public node API, read at past block heights, showed that trading returned on Bitcoin Cash, Dogecoin, Litecoin and Zcash between about 11:36 a.m. and 11:43 a.m. ET. Bitcoin came back at about 12:09 p.m. ET. Ethereum and Tron resumed at about 2:58 p.m. ET.
As of 3:50 p.m. ET on Nov. 3, BNB Smart Chain was still halted. Cosmos Hub and Solana were also still offline, and node data showed both had been halted since before the reorg.
By that time, Unchained said it had found no announcement from THORChain about the restart.
Jonty says operators would need to vote to switch it back on
In an Unchained episode recorded on Nov. 2, when 10 chains were still halted, Pangolin Intelligence founder Jonty, who posts as tanuki42, said node operators would have to vote to upgrade the protocol and turn it back on.
He said an operator voting yes would be doing so knowingly, expecting that North Korea would use THORChain to launder “literally like billions of dollars of stolen money.” He added that he would not vote for that to happen.
THORChain’s public position
THORChain’s official account said on Nov. 1 that nodes would decide to re-enable chains as they were deemed safe. In a Nov. 2 post, the project said there is no single developer or entity in control of THORChain.
Co-founder Chad Barraford wrote on Oct. 31 that THORNode operators had zero information that was not already public and readily available in real time, after the FBI asked THORNode operators and others to block addresses tied to the hackers.
Fellow co-founder JP Thor said on Nov. 1 that operators who were uncomfortable could leave, others could join, and nobody knows the full set of THORNodes.
Dispute over the Binance link
Jonty also challenged a Nov. 2 post from Arkham that said the Binance hacker had been seen depositing to Binance. That post has since been deleted.
According to Jonty, Arkham had traced funds through THORChain’s Asgard vaults to traders who arbitrage against them. Many of those arbitrage traders use Binance for liquidity, he said. In that setup, he said, it is a mischaracterization to say the funds were being laundered directly through Binance.
Onchain analyst SomaXBT made the same point in a reply to Arkham, writing that the flagged address was the THORChain Asgard Vault and that the Binance deposits were paid by THORChain accounts rather than by the hacker.
Jonty said it remains an open question whether Binance will keep supplying that liquidity. “I imagine that’s a debate that’s being had internally at Binance,” he said.
Claim on how much activity was laundering
Asked what share of THORChain activity was laundering, Jonty said that on the days of most hacks he attributed to TraderTraitor, the FBI’s name for the North Korean group, including incidents involving Bitget, LayerZero and WazirX, more than 99% of THORChain volume on those days was people laundering money on behalf of North Korea.
He said he did not know the share across all time, though he imagined it was still the vast majority. The figure was his estimate, and he did not cite a dataset. Unchained said it found none measuring that share.
THORChain’s Nov. 1 post did not give a date for reopening the chains that remain halted.
