THORChain is back at the center of a familiar controversy after the more than $6 billion Binance theft, but this time the market reaction has broken from the pattern seen in earlier hack-driven flows.
In past major crypto thefts, THORChain often drew criticism for sticking to its decentralized stance while serving as a route for cross-chain fund movements. Those episodes frequently coincided with stronger RUNE price action as illicit flows boosted activity on the network. This time, RUNE moved the other way.
Pressure from the FBI, an unexpected technical failure and long-running accusations of double standards are now feeding a deeper trust problem around the protocol.
FBI asked market participants to block addresses, THORChain declined
Days ago, Binance suffered a theft worth more than $6 billion. The Federal Bureau of Investigation later said the attack was carried out by TraderTraitor, a North Korean hacking group. The report said the same group was also behind the roughly $1.5 billion Bybit theft in February 2025. TraderTraitor is described as a core branch of Lazarus Group focused on cryptocurrency theft and long-term fundraising for North Korea through stolen digital assets.
After the attack, the FBI, the U.S. Secret Service and IRS Criminal Investigation issued a warning saying the attackers were converting large amounts of stolen assets into ETH and were expected to keep moving and laundering funds through DeFi protocols and instant swap services. The FBI called on THORChain node operators, RPC node operators, instant swap platforms, DeFi service providers and blockchain analytics firms to block transactions involving the relevant addresses. It also published hundreds of linked addresses across ETH, BTC and SOL.
Most crypto projects chose to cooperate with law enforcement requests and helped freeze related assets. In the end, about $3 billion in affected funds was successfully frozen. THORChain took a different line. Citing protocol neutrality and a permissionless design, it refused to proactively censor or block transactions tied to specific addresses. The protocol, already known as a long-used route for hackers moving funds across chains, was described in the report as the largest laundering outlet in the Binance theft.
Responding to criticism, THORChain co-founder Chad Barraford said he wants law enforcement to catch those involved in the Binance hack, but argued that THORNode operators do not hold any information that is both non-public and unavailable in real time. In his view, investigators do not need subpoenas or similar legal processes to obtain that information, and direct access is the best path for an investigation.
Barraford also said that after large-scale hacks, attackers usually try to move funds out of the crypto ecosystem and eventually convert them into dollars through centralized institutions because that is a more effective laundering route. Centralized exchanges, he said, hold identity information and communication records tied to the relevant individuals and should cooperate with law enforcement.
Another THORChain co-founder, JP Thor, also opposed pausing the protocol to satisfy law enforcement demands. He said that if people do not believe Ethereum or Bitcoin nodes should stop operating or censor transactions because of law enforcement requests, then THORChain nodes should not be expected to do so either. At one point, he even said that if THORNode operators decided to shut down the entire protocol the following week, the experiment would be over. That post was later deleted after outside pressure.
An Ethereum reorg triggered a bug and interrupted the hackers’ route
Then the story took an unexpected turn.
On the morning of Oct. 31, an Ethereum chain reorganization caused an abnormal event on THORChain. The protocol mistakenly issued a double refund to a user who had deposited 10 ETH, and that error triggered an emergency halt. During the pause, most of THORChain’s cross-chain swap functions were shut for all users, which also prevented the North Korean hackers from continuing to move funds through the protocol.
The technical failure slowed the laundering process for a large share of the stolen Binance assets and gave law enforcement agencies and tracking firms a valuable window.
In its latest disclosure on the incident, THORChain said the user voluntarily returned the extra 10 ETH and that the protocol treasury has regained solvency. The core development team is now working on a fix, while node operators will decide when each chain can reopen based on security assessments.
The halt revived accusations of double standards
The protocol pause caused by the Ethereum block reorganization has also revived a long-running argument over whether THORChain applies its decentralization principles selectively.
That criticism did not begin with this case. In the Bitget theft in September this year, THORChain was also accused of taking a selective approach to decentralization after it refused to help freeze hacker-linked addresses.
The dispute centers on two different responses. When hackers use THORChain to move stolen funds across chains, the protocol typically refuses to freeze or intercept those transactions, citing decentralization, permissionless access and censorship resistance. That position is consistent with its stated principle of protocol neutrality, but it has also made THORChain a recurring route for illicit transfers. Yet when the protocol’s own interests are affected or security risks emerge, the core team and validators can step in quickly through manual coordination or by pausing the network. That contrast — non-intervention outwardly, emergency intervention internally — has kept questions alive about how far its decentralization claims really go.
Fee income is seen as one important factor. Heavy transaction volume generated by hackers moving stolen funds through THORChain can produce meaningful fee revenue for the protocol and lift network activity at the same time.
RUNE failed to repeat earlier patterns as regulatory and security risks took center stage
In several earlier hack cases, this kind of inflow often acted as a catalyst for RUNE. The Binance theft has not produced the same result. CoinGecko data shows RUNE fell about 17.7% over the past 24 hours.
Rather than focusing on the short-term boost that extra flow might bring, the market now appears more concerned with the regulatory and security risks surrounding THORChain.
On the regulatory side, direct intervention by U.S. law enforcement has put THORChain’s long-stated permissionless model under a real-world test. U.S. President Donald Trump also said he is looking into the incident. He added that it is not yet clear whether the attack is tied to North Korea, but if North Korea is confirmed to be involved, he will address the matter with North Korea.
For years, THORChain has presented decentralization, permissionless access and censorship resistance as core selling points. It has argued that users do not need approval from centralized institutions and that the protocol lacks a traditional single point of control, setting it apart from centralized exchanges. With law enforcement now involved, THORChain and related node operators face a difficult choice. Refusing to block the funds could expose them to greater legal and regulatory pressure for failing to cooperate. Complying, on the other hand, would imply that the protocol or its related nodes can intervene in specific transactions, which would weaken the neutrality and censorship-resistance claims it has emphasized for years.
The timing of the halt has also drawn attention. It came after the FBI publicly applied pressure and after THORChain publicly refused to cooperate, leading some in the market to speculate whether the protocol used the Ethereum reorg as cover for a convenient shutdown. At this stage, though, there is no evidence that the pause was an intentional act of cooperation with law enforcement. According to THORChain, it was an accidental technical failure.
Another security issue adds to the strain
Regulatory pressure is only part of the problem. A series of technical issues has also deepened market concern over THORChain’s security.
Several months ago, THORChain suffered a security attack worth about $10.7 million. In the latest case, an Ethereum chain reorganization led to an abnormal refund event and forced the protocol to suspend trading services across multiple chains. Repeated security and technical incidents are pushing the market to reassess its risk controls and raising fresh questions about its ability to handle funds in a complex cross-chain environment.
At the core of THORChain’s current predicament is the tension between its decentralization ideals and its practical incentives. In the past, cross-chain movement of hacker funds brought transaction volume and fee revenue. Now, as regulatory pressure rises and security risks keep surfacing, those gray-area flows are eroding market trust and leaving the protocol caught between defending its principles and dealing with mounting survival pressure.
