THORChain Restarts Most Swaps After Analyst Said Operators Would Expect North Korea to Launder

THORChain is a permissionless cross-chain swap protocol with no custodian; independent node operators validate and co-sign every outbound transaction, which is what let a single-block Ethereum reorg on Oct. 31 trip a refund bug and halt the whole network rather than one account. The same mechanism that stopped ordinary traders also froze funds Lazarus Group-linked hackers were routing through the protocol from the Binance theft, echoing THORChain's earlier role moving Bybit's stolen funds.

Bitcoin, Ethereum and several other chains are swapping again as of 3:50 p.m. ET on Nov. 3, letting most traders and arbitrageurs resume activity that had been frozen for days. Cosmos Hub, BNB Smart Chain and Solana users still cannot trade or trigger outbound signing, so anyone needing liquidity on those three chains stays locked out. Liquidity providers on the restored pools regain fee income and price exposure; those tied to the three paused chains do not. (per thedefiant.io)

A protocol built to have no administrator cannot selectively freeze illicit flows without freezing everyone, so a bug that briefly trapped North Korean-linked funds trapped every honest user alongside them. That is the cost of genuine permissionlessness: no operator can carve out an exception for bad actors without first building the capability to carve out exceptions at all, which undercuts the neutrality THORChain is designed around. The episode is a real test of whether decentralized infrastructure can resist being a laundering channel without becoming something else.

Full normalization depends on the 14 nodes The Defiant identified as not yet upgraded; until they run the patched software, Cosmos Hub, BNB Smart Chain and Solana stay restricted. Watch for THORNode data confirming those three chains reopen trading and outbound signing, and for whether the delay gives the Lazarus-linked funds identified around the Binance theft a renewed path to move once the network is fully back online.