NODORAExploreDiscussionsCommunitiesNewsChartsLaunchpad

THORChain (RUNE) Restarts Swaps on 10 Chains, Token Jumps 13%

By Nodora News ·

THORChain (RUNE) has restarted swaps on 10 of 13 networks after an Ethereum reorg forced a halt, reopening a route linked to Binance hack funds.

THORChain (RUNE), the cross-chain swap protocol that halted trading on most of its connected networks over the weekend, has switched swaps back on for Bitcoin, Ethereum, Tron and several other chains. Trading resumed in stages on Tuesday, November 3 (US time), and by Wednesday the network's status page showed trading and transaction signing marked "OK" on 10 of its 13 external networks. RUNE climbed roughly 13% to 15% over 24 hours to about $0.63 as routes reopened.

The restart closes out a pause that began with a software bug, but it also reopens a route that blockchain analysts say North Korean hackers were using to move funds stolen in the record $6.3 billion Binance hack.

Key takeaways

What happened: why THORChain halted swaps

The trouble started at 11:34 UTC on Saturday, October 31, when Ethereum went through a one-block reorganisation, or "reorg". A reorg happens when the network swaps a recent block for a competing one, so transactions in the dropped block can effectively disappear.

In this case, a 10 ETH deposit that THORChain had already credited vanished with the dropped block. The related swap then failed its price limit, so THORChain refunded the user from its vault. But the vault had never really received that deposit, and the sender's original deposit was refunded as well. The result was an extra 10 ETH paid out, which tripped the protocol's automatic solvency check and paused outbound Ethereum transactions.

THORChain's team warned publicly that, now the flaw was known, a malicious actor could try to repeat the trick every time an external chain reorganised. Node operators, the independent validators who run the network, then voted to widen the halt to 10 networks while developers worked on a fix. Trading continued only on Avalanche, Base and XRP Ledger.

How the restart unfolded

According to THORChain's own node data, reviewed by Unchained, trading came back in stages on November 3 (US Eastern time):

That works out to roughly 3:36 a.m. to 6:58 a.m. AEDT on Wednesday, November 4. Cointelegraph and TokenPost later reported that THORChain's status page showed 10 of 13 external networks fully operational. BNB Smart Chain, Cosmos Hub and Solana still show warnings for both trading and signing; node data suggests Cosmos Hub and Solana had been paused since before the reorg.

THORChain had said on November 1 that "nodes will decide to re-enable chains as they are deemed safe", and as of Unchained's check there was no formal announcement of the restart.

Why it matters: the Binance hack link

The halt landed in the middle of the fallout from the $6.3 billion Binance hack, which the FBI has attributed to North Korea. Cross-chain swap services like THORChain let users move value between blockchains without a central exchange, and analysts have tracked hack proceeds passing through it. Nodora covered that flow earlier in how Binance hackers laundered $242M through cross-chain services.

Chainalysis said the emergency pause had "inadvertently delayed" that laundering, because it stopped every user, hackers included, from using most of THORChain's cross-chain routes. The FBI had asked THORChain node operators and others to block addresses linked to the attackers.

That makes the restart controversial. Jonty, founder of research firm Pangolin Intelligence, said on an Unchained episode recorded November 2 that any operator voting to switch the network back on would be doing so "knowingly", expecting North Korea to use it to launder stolen funds. He estimated that on the days of several earlier North Korea-linked hacks, more than 99% of THORChain volume came from laundering, though he cited no dataset for that figure.

THORChain's co-founders reject the idea that the protocol can act like a company. The project said on November 2 that "there is no single developer or entity in control of THORChain", and co-founder Chad Barraford said operators have no information that isn't already public on-chain.

Market reaction: RUNE, BTC and ETH prices

RUNE was the clear outlier in a quiet market. Prices as of about 12:50 p.m. AEDT on November 4:

RUNE's market value is now about $206 million. The token earns value from swap fees, so traders appear to be pricing in the return of volume, but that volume may come under closer scrutiny if a large share of it is linked to hack proceeds. You can follow the wider market on Nodora Charts.

Ethereum (ETH) live price, the network whose reorg triggered the halt:

Ethereum ETH$1,831 -6.01% 24h
7-day price · updates every few minutesOpen the live chart · ETH price page

What to watch next

For the full background on the attack, read Nodora's coverage of how the Binance hack began with a fake job interview.

This article is for information only and is not financial advice.

SourcesCointelegraph, Unchained, TokenPost +15
  1. CointelegraphRUNE rallies 15% as THORChain restarts most swaps after halt
  2. UnchainedTHORChain Restarts Most Swaps After Analyst Said Operators Would Expect North Korea to Launder
  3. TokenPostTHORChain Restores Most Swaps as RUNE Gains 15% After Outage
  4. CointelegraphTHORChain halts swaps after block reorg bug, slowing Binance hackers
  5. CoinGeckoTHORChain (RUNE) price

#THORChain #RUNE #Binance Hack #DeFi #Ethereum

This article is general information, not financial advice.

Open Nodora News in the app