THORChain had switched swaps back on for most of the chains halted after an Oct. 31 Ethereum reorg, according to the network’s own THORNode data, read at 3:50 p.m. ET on Nov. 3. As Unchained reported Nov. 2, the halt, which began when a one-block Ethereum reorg tripped a refund bug, also held up North Korean hackers moving funds stolen from Binance.

The /inbound_addresses endpoint of THORChain’s public node API, read at past block heights, shows trading came back on Bitcoin Cash, Dogecoin, Litecoin and Zcash between about 11:36 and 11:43 a.m. ET, on Bitcoin at about 12:09 p.m. ET and on Ethereum and Tron at about 2:58 p.m. ET. BNB Smart Chain was still halted at 3:50 p.m. ET, as were Cosmos Hub and Solana, which node data shows had been halted since before the reorg. Unchained found no announcement of the restart from THORChain by then.

On an Unchained episode recorded Nov. 2, while 10 chains were still halted, Jonty, founder of Pangolin Intelligence, who posts as tanuki42, said that node operators were “going to have to vote to upgrade the protocol and switch it back on.” An operator who voted yes, he said, would be “knowingly doing so,” in anticipation that North Korea would use THORChain to launder “literally like billions of dollars” of stolen money. He added that he “wouldn’t vote for that to happen.”

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

THORChain’s Position

THORChain’s official account posted on Nov. 1 that “nodes will decide to re-enable chains as they are deemed safe.” In a Nov. 2 post, it said that “there is no single developer or entity in control of THORChain.”

Co-founder Chad Barraford wrote on Oct. 31 that “THORNode operators have zero information that isn’t already public and readily available in real time,” as the FBI asked THORNode operators and others to block addresses tied to the hackers. Fellow co-founder JP Thor posted on Nov. 1 that operators who are uncomfortable can leave and others can join, and that “nobody knows who the full set of THORNodes are.”

The Binance Link

Jonty also disputed a Nov. 2 post from Arkham saying the Binance hacker had been spotted depositing to Binance. That post has since been deleted. Arkham had traced funds through THORChain’s Asgard vaults to the traders who arbitrage against them, he said. “A lot of those arbers use Binance for liquidity,” he added.

“It’s a mischaracterization to say that funds are directly being laundered through Binance in that scenario,” he said.

Onchain analyst SomaXBT made the same point in a reply to Arkham, writing that the flagged address was “the Thorchain Asgard Vault,” and that “those Binance deposits were paid by Thorchain accounts” rather than by the hacker.

Jonty said whether Binance keeps supplying that liquidity is an open question. “I imagine that’s a debate that’s being had internally at Binance,” he said.

Asked how much THORChain activity is laundering, he said that on the days of most hacks he attributed to TraderTraitor, the FBI’s name for the North Korean group, including those on Bitget, LayerZero and WazirX, “99%-plus of the volume through THORChain on those given days” was “people laundering money on behalf of North Korea.” He said he did not know the share over all time, though he imagined it was still the vast majority. The figure is his estimate; he cited no dataset, and Unchained found none that measures it.

THORChain’s Nov. 1 post gave no date for reopening the chains that remain halted.

Related Listen: How North Korea Stole $6.3 Billion From Binance in 20 Minutes