THORChain faces scrutiny after refusing to block Binance hack flows as RUNE drops 17.7%
THORChain is under renewed pressure after the more than $6 billion Binance theft pushed the cross-chain protocol back into the center of a laundering debate that has followed it through past crypto hacks. The FBI said the attack was carried out by TraderTraitor, a North Korean hacking group tied to Lazarus Group and also linked in the report to the roughly $1.5 billion Bybit theft in February 2025. U.S. authorities then urged THORChain node operators, RPC providers, instant swap services, DeFi platforms and blockchain analytics firms to block transactions involving hundreds of listed ETH, BTC and SOL addresses. THORChain did not comply, saying its protocol is neutral and permissionless. Co-founder Chad Barraford said investigators do not need subpoenas to access the information THORNode operators can see, while co-founder JP Thor argued THORChain nodes should not be expected to censor transactions if Ethereum and Bitcoin nodes are not held to the same standard. Then an Ethereum chain reorganization on Oct. 31 triggered an abnormal double refund on a 10 ETH deposit, forcing an emergency halt across much of THORChain’s cross-chain swap functionality. That pause also stopped North Korean hackers from continuing to move funds through the protocol. THORChain later said the user returned the extra 10 ETH and the treasury is solvent again. CoinGecko data shows RUNE fell about 17.7% over the past 24 hours, as attention shifted from fee-driven activity to regulatory and security risk.








