THORChain Is Back Online: $6.3B Binance Hackers Rushed Back Within Hours — RUNE Jumped 15% as the Freeze Race Restarted

The switch flipped back on — and the hackers were already waiting

THORChain switched most cross-chain swaps back on on November 3, 2026 — and the group behind the record $6.3 billion Binance theft was moving stolen ether into bitcoin through the network within hours. The restart ended a weekend freeze that had accidentally done what investigators could not: it locked the laundering route. Within a day, RUNE had jumped about 15% to around $0.64, while Binance said about $2.85 billion remained frozen and roughly 98% of affected tokens had been replenished with company money. In short: a 10 ETH bug froze a multi-billion-dollar escape route, a node upgrade reopened it, and the freezing-versus-laundering race restarted — with the finish line in bitcoin, the one asset no issuer can freeze.

This article explains what happened, in order, with the numbers that matter: the October 31 reorganization that broke THORChain, the November 3 restart chain by chain, the laundering path trackers saw within hours, and how much is frozen versus how much has already slipped into bitcoin. If you hold coins on an exchange or accept crypto payments, this plumbing touches you — tainted funds do not stay neatly inside one protocol.

What THORChain is, and why hackers love it

THORChain is a decentralized cross-chain swap network: it lets users trade one blockchain's native coin for another's — bitcoin for ether and vice versa — without an exchange account, identity checks, or a single company holding the funds. Swaps run through vaults controlled by rotating node operators, and liquidity providers earn fees on the trades. For legitimate users, that is the appeal: no account, no custodian, settlement across chains in minutes. For thieves, the appeal is identical — with the morality removed.

A centralized exchange can freeze an account, block a deposit, and hand an address list to law enforcement. A stablecoin issuer can freeze tokens at the smart-contract level. THORChain has no account to close and no issuer to call. Its emergency controls can halt broad activity across the network, but — as the protocol itself has said — they cannot freeze an individual swap. That distinction is the heart of this story, and it is why the FBI's October 31 request to block TraderTraitor addresses could only ever be partly honored: the official front end blocked the flagged addresses, while independent node operators could still process trades.

THORChain has been here before. After the Bybit hack, it processed a then-record $4.66 billion in swaps in the week ended March 2, 2025. In September 2026, it declined a Bitget request to block addresses tied to a $388 million breach, again because its controls halt activity broadly rather than freezing individual swaps. Neutrality, in a laundering case, is itself a decision. See What Is a DEX? DEXs Just Hit a Record 23% of Spot Trading After the $6.3B Binance Hack — 5 Checks Before Your First Swap.

The 10 ETH bug that accidentally froze a $6.3 billion escape route

The freeze had nothing to do with the hack. At 11:34 UTC on Saturday, October 31, Ethereum briefly replaced a recent block with a competing one — a reorganization, or reorg. The discarded block held a 10 ETH deposit THORChain had already recorded. When that swap failed its price limit, THORChain refunded the deposit it believed it held — and also the real one. The vault ended up 10 ETH short, roughly $23,000 at the time.

That shortfall tripped an automatic solvency check and the network stopped: node operators cut off outgoing ether transactions about two minutes later, and a three-node vote paused every chain as a precaution. Blockchain analytics firm Chainalysis, which puts the Binance theft near $6.4 billion and calls it the largest theft in crypto history, said the pause had "inadvertently delayed the laundering of a significant amount of funds stolen from Binance" because it locked everyone, hackers included, out of most of THORChain's bridges.

THORChain's team also flagged a darker footnote: the flaw was now public, and after any reorganization on an outside chain, "a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults." The bug was a disclosed vulnerability class that needed a fix before reopening — which is why the restart took a node upgrade, version 3.21.1, shipped as a private Bifrost-only binary with extra security patches.

The restart, chain by chain: November 3, in order

THORChain issued no formal restart announcement; public node data showed chains returning one by one on November 3. Bitcoin Cash, Dogecoin, Litecoin and Zcash came back around midday Eastern; bitcoin followed at about 12:09 p.m. ET; ethereum and Tron at about 2:58 p.m. ET. Version 3.21.1 later confirmed swaps active on 11 blockchains, while Solana, BNB Smart Chain and Cosmos stayed halted, with eight nodes still to upgrade.

The staggered restart shows how decentralized the decision is: no single switch, but a rolling upgrade across more than 100 nodes, with 103 of 111 on the latest version by mid-morning UTC on November 4. The chains that stayed halted — Solana, BNB Chain and Cosmos — were routes the hackers had used heavily before the freeze, so the partial reopening was only a partial reprieve. The routes that did return — above all ether into bitcoin — were the ones the laundering playbook needed most.

The laundering path trackers saw within hours

Trackers saw the hackers return almost immediately. Per CoinDesk, Lookonchain observed the attackers splitting stolen SOL across wallets, selling it for USDC, moving proceeds to Ethereum, buying ether, then swapping ether for bitcoin through THORChain. Cointelegraph reported about 81% of the stolen SOL had moved. Chainalysis estimated roughly $500 million passed through Tron, including repeated transfers between wallets — a pattern consistent with layering, where money is moved repeatedly to blur its trail.

Earlier figures show what the route costs. In a November 1 snapshot, investigator SomaXBT estimated the attackers pushed about $48.3 million through THORChain and received $42.7 million — roughly 12% lost to fees and slippage across 2,697 deposits — while front-end interfaces earned an estimated $95,000 in affiliate fees. A 12% haircut is enormous in absolute terms, but for a thief converting stolen funds into an unfreezable asset, it is a price worth paying. Every hop into native bitcoin or ether shrinks the pool that can ever be clawed back.

The key mechanic: stablecoins such as USDT and USDC have issuers that can freeze tokens, and those issuers have frozen more than $3 billion of the stolen funds, per CoinDesk. Chainalysis documented the attacker swapping $325 million in stablecoins for about $285 million in ether within roughly 20 minutes of the theft, to stay ahead of those freezes. Bitcoin and ether have no issuer that can lock a wallet — so the laundering playbook is a race against the freeze list, and THORChain's reopening restarted the clock in the launderers' favor. For wider context, see Binance Hack: 12,000 Wallets, the Laundering Machine, and the Myths That Don't Survive the Data and FBI Names North Korea in the $6.3B Binance Hack: TraderTraitor, the Blocklist, and What Comes Next.

Timeline: from the hack to the reopening

The timeline below ties the case together, from the protocol's account, FBI statements, and the trackers cited above. Where sources disagree — $6.3 billion from Binance, near $6.4 billion from Chainalysis — both figures are shown.

Date	What happened	Why it matters
October 29, 2026	Binance loses about $6.3 billion from hot wallets, the largest crypto theft on record. The FBI later attributes it to North Korea's TraderTraitor group.	Sets the largest-ever laundering operation in motion.
October 29–30	Attacker swaps about $325 million in stablecoins for about $285 million in ether within roughly 20 minutes, ahead of issuer freezes.	Shows the freeze race starts in minutes, not days.
October 31, 11:34 UTC	An Ethereum reorg discards a block holding a 10 ETH deposit; THORChain double-refunds it, trips its solvency check, and halts swaps.	A $23,000 bug accidentally freezes the escape route.
October 31	The FBI asks THORChain node operators and other DeFi services to block TraderTraitor addresses; the front end complies, node-level swaps cannot be individually frozen.	Exposes the limit of asking a decentralized protocol to censor.
November 1	Snapshot: about $48.3 million pushed through THORChain for $42.7 million out — a 12% fee-and-slippage haircut across 2,697 deposits.	Puts a price on laundering through THORChain.
November 3	Swaps return chain by chain: BCH, DOGE, LTC, ZEC around midday ET; BTC at 12:09 p.m. ET; ETH and TRON at 2:58 p.m. ET. Trackers see hacker flows resume within hours.	The freeze window closes; the laundering window reopens.
November 4	Version 3.21.1 confirms 11 chains active; SOL, BNB Chain and Cosmos still halted. RUNE trades around $0.64, up about 15% in 24 hours. Binance says about $2.85 billion frozen, about 98% of tokens replenished.	The market prices the restart; the recovery total is now measurable.

RUNE jumped 15%: what the market is really pricing

RUNE rose about 15% over 24 hours as swaps resumed, trading around $0.64 on Wednesday per CoinMarketCap data cited by Cointelegraph (an earlier snapshot put the gain at 10.6% to $0.637). The reason is uncomfortable: the network earns fees whoever is on the other side of the swap. More volume — legitimate or illicit — means more fees for liquidity providers and more demand for RUNE, used for settlement and security.

That creates a conflict no press release can resolve. Pangolin Intelligence founder Jonty said before the restart that operators voting to reopen would do so knowing North Korea would use the routes, and that he would not vote for it. He estimated that on days tied to major TraderTraitor breaches, more than 99% of THORChain's volume was regime laundering — a figure Unchained noted was his own estimate, with no dataset behind it. Even discounted, it captures the dilemma: a neutral protocol cannot distinguish a launderer's swap from a trader's, and its token holders profit from both.

For ordinary holders, the RUNE jump is a warning, not a signal. A token rallying because a laundering route reopened carries regulatory risk no price chart shows: lawmakers cite cases like this when arguing DeFi needs the same anti-money-laundering duties as exchanges, and a future sanctions designation or delisting would hit RUNE far harder than one day's fee revenue can justify.

What happens next: the three chokepoints left

With swaps running again, pressure shifts downstream to where stolen crypto must become spendable cash. Elliptic said only a negligible share of the proceeds had likely been cashed out so far and expects the group to convert more ether into bitcoin in smaller amounts before cashing out through over-the-counter (OTC) brokers over months. Those brokers are the next chokepoint — and the one where investigators have most leverage, because OTC desks have bank accounts and compliance teams that can be pressured.

The second chokepoint is exchanges providing liquidity to arbitrageurs who rebalance against THORChain's vaults. Analysts clarified that flagged deposits into Binance came from intermediary arbitrageurs interacting with the Asgard vaults, not directly from the exploiters — so tainted value can spread a few hops before ever touching a centralized exchange. Any company accepting crypto can end up touching funds that passed through a laundering route, which is why blockchain screening before accepting deposits is becoming a basic control, not an extra.

The third chokepoint is the remaining halted chains. Solana, BNB Chain and Cosmos are still suspended, and how quickly they return — and with what screening — will shape how much remaining stolen supply can move at all. The practical lesson: keep most holdings in self-custody, verify an exchange's proof of reserves before trusting it with size, and treat any "too fast, too anonymous" swap route as counterparty risk, not a feature. Our guides How to Buy Bitcoin Safely in 2026: The $6.3B Binance Hack Changed the Rules — 7 Steps That Keep Your BTC Yours and Best Crypto Wallets in 2026: 7 Compared After the $6.3B Binance Hack — Prices, Security, and the 1 Beginner Mistake to Avoid walk through exactly those steps.

5 checks before you use any cross-chain swap

Cross-chain swaps are legitimate tools, and most users will never touch a stolen coin. But the THORChain case shows five checks worth running before any swap, especially while tainted funds are moving fastest.

1. Check the route's status, not just its price. A halted chain or solvency pause can strand funds mid-swap; the protocol's status page is the source of truth, not a front-end quote.
2. Expect slippage to be the real fee. The headline rate hides the spread: the Binance launderers lost about 12% across thousands of deposits, and retail swappers on volatile routes can lose a meaningful slice the same way.
3. Assume your coins will be screened downstream. If your coins passed through a flagged route, an exchange deposit can be frozen even if you did nothing wrong. Keep records of where your funds came from.
4. Prefer native assets over freezable wrappers for censorship resistance — and understand the trade-off. Bitcoin and ether cannot be frozen by an issuer, but they cannot be recovered if sent to the wrong address. There is no support desk.
5. Never swap your entire stack in one transaction during a crisis. Split large moves, test with a small amount first, and wait for confirmation on both chains. The 10 ETH bug shows even mature protocols fail in edge cases.

What most people get wrong about this story

Three misconceptions recur in coverage of the restart. First, that THORChain "chose" to help the hackers: operators voted to restart a network serving all users, and it cannot selectively refuse one swap without redesigning its core model — which is also why the FBI's request was unenforceable at the protocol layer. Second, that the freeze "worked": it did not recover money, it delayed its movement. About $2.85 billion was frozen because issuers and exchanges acted within hours, and that speed — not the THORChain halt — saved the recoverable share. Third, that RUNE's rally means the market approves: markets price volume, not virtue, and a reopening fee-earning network will usually rally regardless of who provides the volume.

The honest summary is narrower: a bug bought investigators a few days, a fix gave launderers their route back, and the remaining fight is over off-ramps, screening, and time. The stolen ether will keep converting into bitcoin in smaller amounts over months, per Elliptic — each conversion makes seizure harder, but the trail stays public forever.

Frequently asked questions

Is THORChain back online now?

Mostly. After version 3.21.1, swaps are active on 11 blockchains including Bitcoin, Ethereum, Tron, Dogecoin, Litecoin and Zcash. Solana, BNB Smart Chain and Cosmos remain halted, so not every route is open yet.

Did the hackers really return within hours of the restart?

Yes, per trackers cited by CoinDesk: attackers split stolen SOL, sold it for USDC, moved proceeds to Ethereum, bought ether, and swapped ether for bitcoin through THORChain. Cointelegraph reported about 81% of the stolen SOL had moved.

How much of the $6.3 billion has been frozen?

Binance said on November 3 that about $2.85 billion had been frozen and roughly 98% of affected tokens had been replenished with company money. Stablecoin issuers have frozen more than $3 billion in total, per CoinDesk — but the frozen and replenished totals measure different things and should not be added together.

Why can't THORChain just block the hackers' wallets?

Its emergency controls can halt broad activity but cannot freeze an individual swap, the protocol has said. The official front end blocked flagged addresses after the FBI's request, but independent node operators can still process trades submitted through other interfaces.

Should I sell RUNE after its 15% jump?

This is not financial advice. Factually, RUNE's rally reflects returning swap volume, including laundering-linked volume, and the token carries regulatory risk — sanctions scrutiny, possible exchange action, node-operator legal exposure — that a price chart does not show. Never invest money you cannot afford to lose.

Does this affect my bitcoin on an exchange?

Not directly, but indirectly yes. Most major exchanges now screen deposits, so coins that passed through flagged routes can trigger a freeze or review even for innocent holders. Keeping purchase records, using reputable exchanges, and moving long-term holdings to self-custody — see our Bitcoin safety guide — are the practical defenses.

Conclusion: the bug bought days, not a solution

THORChain's reopening closed the strangest chapter of the Binance hack: a weekend in which a 10 ETH accounting error did more to slow North Korea's laundering machine than any regulator or exchange. The restart was technically necessary — a network cannot stay halted forever, and 3.21.1 fixed the disclosed refund flaw — but it handed the thieves back their most useful tool, with $2.85 billion frozen, about 81% of the stolen SOL already moved, and roughly $500 million traced through Tron. RUNE's 15% jump tells you the market noticed the volume; it does not tell you the volume was clean.

What happens next will not be decided on THORChain at all, but at OTC desks, exchange compliance desks, and in the slow public work of tracing funds hop by hop over months. For everyone else, the lesson is one the whole Binance saga keeps teaching: in crypto, the plumbing matters as much as the price. Know which routes your coins travel, and keep long-term holdings where no one else's bug or freeze can touch them.

Sources: QUE.com — THORChain Reopens Swaps and North Korea's Binance Hackers Rush Back In; Cointelegraph — RUNE Jumps 15% as THORChain Restores Swaps After Bug; CoinStats — THORChain Reopens Trading on 11 Chains; Coin-Turk — THORChain Resumes Swaps on 11 Blockchains. Prices and figures are as reported on November 3–4, 2026 and move quickly; this article is for information only, not financial advice.