A 10 ETH Bug Did What the FBI Asked For. THORChain Accidentally Locked North Korea Out of Its Favorite Laundering Route

On Saturday the FBI asked THORChain node operators to block transactions tied to North Korea’s TraderTraitor, the group it blames for the $6.3 billion Binance hack.

THORChain didn’t have to decide whether to do it. A 10 ETH accounting bug shut down most of the protocol first.

“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis said, per Cointelegraph. “Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.”

The industry has spent years arguing about whether a “permissionless” protocol can ever be stopped. This time one bad block on Ethereum did it.

What Happened

THORChain’s own post-mortem, as quoted by Blockchainreporter and Cointelegraph, gives this sequence:

1. 11:34 UTC, Saturday October 31. Ethereum reorganized a single block. That block contained a 10 ETH deposit to a THORChain vault, and the deposit never made it onto the canonical chain.
2. THORChain had already credited it. Its observers had seen the deposit before the reorg. According to Blockchainreporter, nodes detected the reorg, but the re-check “could not return a clear answer in time, so it was finalized as if real.”
3. The swap failed, so THORChain refunded it. The swap missed its price limit, so THORChain sent back 10 ETH, “a refund against funds the vault had never received” (Cointelegraph). The sender’s real deposit was refunded too. Blockchainreporter summed it up: “one reorg turned into two outbound payments on the same collateral.”
4. Solvency checker trips. THORChain’s solvency checker spotted the shortfall and halted ETH. Per THORChain, “Within approximately two minutes, node operators halted ETH transaction signing, so no further ETH could leave the vaults.” More node votes then halted every chain “as a precaution so core developers could investigate.”

On November 1 THORChain posted that “The 10 $ETH has been returned by the user to make the vault solvent again.” (We could only trace that claim to one outlet’s reporting of THORChain’s post. Cointelegraph doesn’t mention it.)

What’s Down and What’s Up

Halted (10 chains)	BTC, ETH, SOL, TRON, BSC, DOGE, LTC, BCH, ATOM, ZEC
Still live	AVAX, BASE, XRPL (and native RUNE)
Resume date	None. THORChain: “Nodes will decide to re-enable chains as they are deemed safe.”

So Bitcoin and Ethereum, the two chains a launderer needs most, are both offline.

Why THORChain Matters to North Korea

THORChain was the main route for the 2025 Bybit theft. Lazarus used it to turn huge amounts of stolen ETH into BTC with no KYC and no company to subpoena. A governance fight over blocking those swaps ended with contributors quitting, and the swaps kept flowing.

That’s why the FBI’s Saturday alert named THORChain node operators directly. It’s also why founder John-Paul Thorbjornsen’s stance, in a separate post quoted by Cointelegraph, reads like an ultimatum:

“IMO if THORNodes decided to take the protocol offline next week then the experiment is over. The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”

Then the protocol went offline anyway, because of a bug rather than a decision.

The block on the hackers isn’t targeted, though. Chainalysis notes the halt is “preventing all users, including DPRK’s money launderers, from using cross-chain swaps.” Everyone else using THORChain is stuck too. And when nodes switch chains back on, the route reopens for everyone, the Binance attacker included, unless node operators decide to filter. Thorbjornsen has just said that would end the experiment.

Meanwhile at Binance: $3.64B Out the Door

On Sunday, Binance also reopened withdrawals for the first time since the October 29 hack:

• Phase one began at 06:00 UTC on November 1 and covered 15 networks: Bitcoin, Ethereum, BNB Chain, Tron, Solana, XRP Ledger, Zcash, Dogecoin, Polygon, Avalanche, Arbitrum, Base, Optimism, TON and Sui (crypto.news). CZ posted: “BTC withdrawal is live.”
• “Approximately 95%” replenished. Co-CEO Richard Teng put it that way, up from 90% on Saturday. As we explained yesterday, that means Binance bought replacement coins with its own money. It does not mean the stolen funds came back. Per Binance’s spokesperson via CoinDesk, the missing 5% is “tokens outside the top ten.”
• $3.64B in net outflows in about 9.5 hours. DigitalToday, citing CoinPost and Binance data, reports $4.65B withdrawn against $1.01B deposited. That’s about 2.1% of the $171B in user assets Binance reported on October 28. Binance says “Withdrawal volumes are decreasing and stabilising as expected after an initial surge.”
• Still pending: everything outside phase one (no timetable yet), and the full proof-of-reserves report. Reports put that at November 2 or 3.

By bank-run standards, losing 2.1% after the largest theft in crypto history is mild. It still works out to roughly $380 million an hour.

Why This Matters for Crypto Jobs

This weekend showed that consensus edge cases, solvency checks and laundering routes all land on the same few teams.

• Cross-chain protocol engineers. THORChain’s bug was a reorg-handling bug, a classic in bridge design. Teams that can reason about finality across 10+ chains, from probabilistic Bitcoin to Ethereum’s reorg-prone unfinalized head, are rare and in demand. Expect every bridge team to audit its own observer logic.
• Solvency and invariant monitoring. THORChain’s automated checker found the problem and halted ETH, and nodes stopped signing within about two minutes. That kind of on-chain circuit breaker is now an expected feature. Engineers who build real-time invariant monitoring for vaults, bridges and exchanges are getting hired.
• On-chain investigators. The halt only buys time. When chains come back, analytics firms, exchanges and issuers need people ready to follow the funds the moment they move.
• Decentralized-infra policy and legal. “Should node operators filter?” is now a question with an FBI alert attached to it. Protocols need people who understand both validator operations and sanctions law.
• Exchange ops and treasury. Getting $4.65B out the door in phased, audited batches without breaking anything is serious operational work. Wallet ops, treasury and reconciliation roles at every major exchange just got a stress-test template.

---

Want to build the systems that catch the next exploit, or the ones that survive it? Browse thousands of open Web3 roles at Cryptogrind, updated daily.