UPDATED 20:48 UTC, 1 Nov: Chainalysis said at 16:59 UTC on Sunday that North Korean-linked actors have “begun a new phase” of laundering the Binance funds: after draining $500 million from Tron staging wallets, they “have started moving onto Solana”. It did not give a Solana amount. The US Secret Service said at 18:11 UTC that it froze “a significant portion” of the stolen crypto with industry partners within minutes of the theft, without giving a figure.
SECURITY ALERT
A blockchain went back in time on Saturday morning.
Somebody got paid twice, and the laundering stopped.
The people moving money from this week’s theft at Binance have lost one of their favourite exits, at least for now.
THORChain, the cross-chain swap network, is in an “emergency pause”, blockchain analytics firm Chainalysis said on X at 17:36 UTC on Saturday.
The cause, according to Chainalysis, was an Ethereum reorg. That is when the network briefly replaces a few recent blocks with a different version of history.
The reorg “caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH”, the firm said.
The pause followed. “Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges,” Chainalysis said.
THORChain had not explained the pause publicly on X as of 21:00 UTC.
What happened, in UTC
- Saturday 31 Oct, morning (time not given). An Ethereum reorg triggers the double refund, according to Chainalysis.
- 11:37. Chainalysis describes the hackers’ Tron method (below).
- 17:36. Chainalysis says THORChain’s pause has “inadvertently delayed the laundering of a significant amount of funds stolen from Binance”.
- 20:41. An analyst who posts as Specter claims $38 million has moved through another bridge, Relay.
- 20:53. Our read of THORChain’s public node shows trading paused on all 13 external chains it lists.
So what does the pause actually block?
What we can see
Our check of THORChain’s node data found every listed chain, from bitcoin and Ethereum to Tron and XRP, marked as halted with trading paused.
Signing of outgoing transactions was switched off for only two of them, Cosmos Hub and Solana. THORChain’s lending was also paused.
The Defiant, reporting at 17:51 UTC, counted swaps paused on 12 of 13 chains.
THORChain was used to move funds after the Bitget hack earlier this month. A THORChain bridge does not freeze anyone. A pause stops everyone.
If one exit closes, where does the money go next?
The Tron route
Chainalysis says the hackers have been working around stablecoin freezes on Tron “since the early hours” of the attack.
The method, as the firm describes it: swap TRX for stablecoins, deposit them in a DeFi lending protocol and take the deposit token that comes back. Unlike the stablecoin, that receipt token cannot be frozen.
The token is moved to a fresh wallet, swapped back into stablecoins and bridged out of Tron for ETH.
Chainalysis traced $500,000 moving this way and attributed it to TraderTraitor, the North Korean group. TRM Labs has also linked the Binance theft to TraderTraitor. Circle and Tether “have already contributed to $2.8 billion in freezes so far”, Chainalysis said.
Stablecoin issuers can freeze a token. Can anyone freeze a claim on one?
The Relay claim
At 20:41 UTC, Specter claimed on X that North Korean launderers had bridged $38 million “in just 7 hours” through the Relay bridge, and were “still bridging”. The post named one Tron address:
TNhpfKq83wufEKGjBhQFnT7jnxYmyBzH6F
CryptoWatchDesk could not confirm the $38 million figure.
Tron’s public records show the address was created at 00:55 UTC on Saturday. Between 08:06 and 20:25 UTC it made 63 transfers in and out of a JustLend TRX vault token, about 123.8 million units each way.
That is a lending-protocol receipt token of the kind Chainalysis describes. It does not, on its own, show where the money went.
Relay had not responded publicly on X as of 21:00 UTC. RUNE, THORChain’s token, was up 5.5% in 24 hours at $0.68, according to CoinGecko.
Protect yourself
- If you have a THORChain swap in flight, keep your transaction hash. Refunds and outbound payments follow the network’s own restart.
- Don’t resend a stuck swap through another interface while chains are paused.
- If an exchange holds a deposit you think is wrongly linked to the hack, ask for the case reference in writing.
- Bridges and lending apps: Chainalysis has published the pattern. Check your own flows against it.
When the pause lifts, will the bridges be ready for the queue?
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.