THORChain halts Bitcoin and Ether swaps: Binance loot stalls, RUNE down 18 percent

THORChain halted trading on ten of its 13 connected blockchains on Saturday, October 31, including Bitcoin, Ethereum, Solana and Tron. The trigger was a technical fault, not a response to the Binance hack. The pause still hits the attackers: part of the loot from the theft of around $6.3 billion was moved through THORChain, and that route is closed for Bitcoin and Ether for now. RUNE, the token the protocol runs on, lost more than 18 percent in 24 hours.

THORChain is a decentralised protocol for cross-chain swaps. Anyone who wants to swap Bitcoin for Ether there needs neither a centralised exchange nor a customer account. That is exactly what makes it popular with hackers, and exactly why it is under pressure from US authorities after the Binance hack.

THORChain pause: an Ethereum reorg triggers the emergency halt

The sequence of events can be pieced together from a THORChain notice reported by TechFlow on November 2. An Ethereum block was replaced after the fact, and with it a deposit of 10 ETH vanished that THORChain had already confirmed. The protocol refunded the amount because the related swap failed at its price limit. After the reorg, however, the deposit it was refunding no longer existed. In the end, 10 ETH left the protocol's vault with no matching inflow.

An automatic solvency check spotted the gap and halted Ether trading first. The node operators, known in the protocol as THORNodes, then also suspended Ether withdrawals and trading on further blockchains. According to node data analysed by The Block on Sunday evening, Central European time, trading was halted on ten of 13 connected blockchains, including Tron, Ethereum and Bitcoin.

What a reorg is

A reorg, short for reorganisation, is when a blockchain replaces one or more already published blocks with a different version. Transactions from the displaced block are then treated as if they never happened until they are included again. On Ethereum, a one-block reorg is rare but possible. A protocol that credits deposits after only a short wait carries that risk itself.

Double refund: why 10 ETH can stop the whole protocol

Measured against the sums in the Binance hack, 10 ETH, or about $23,000 at today's Ether price of around $2,307, is a trifle. For THORChain, though, what matters is the mechanism rather than the amount. If a confirmed deposit can disappear after the fact, the same sequence can in principle be repeated, and every repetition drains money from the vaults. As long as the cause has not been fixed, the affected networks therefore stay closed.

The shortfall has since been covered. According to the same notice, users returned the 10 ETH paid out in error, and the affected vault is solvent again. The node operators decide for themselves when to restart each network, once they consider it safe. There is no date.

Binance loot on Tron: $242 million moved in two days

Alongside the pause, analysts are tracking where the loot from the Binance hack is going. The Block relies on on-chain analyst SomaXBT, who works with the security alliance SEAL. According to that analysis, around $242 million was laundered on Tron within two days. The attackers had taken about $628 million on that blockchain, of which stablecoin issuer Tether froze 378.7 million USDT.

Of the $242 million, around $194 million left the Tron blockchain via bridges and swap services, according to the analysis cited by The Block. The largest items according to SomaXBT:

• Relay: $48 million
• THORChain: $44 million
• Chainflip: $32.1 million
• Symbiosis: $16 million

About $26 million stayed on Tron, and around $22 million was lost to fees, slippage and price moves. According to the same data, THORChain paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses before the halt took effect.

The FBI attributes the attack to the North Korean group TraderTraitor, The Block reports. The agency has not published its evidence.

FBI blocklist: swap services asked to block 608 Ethereum addresses

Together with the Secret Service and IRS Criminal Investigation, the FBI has published 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that it attributes to the attackers. Tron addresses are not on the list. The agency explicitly called on operators of THORNodes, RPC nodes, instant swap services and DeFi protocols to block transactions with these addresses. In the FBI's assessment, the attackers are mainly converting the loot into Ether.

THORChain has not yet said whether it will comply. Co-founder Chad Barraford said on X, according to The Block, that node operators hold no information that is not already public. The halt of entire blockchains that is now slowing the attackers was thus triggered by a software fault, not by a decision of the operators.

According to The Block, analytics firm Chainalysis read the pause as also blocking the launderers. Anyone currently trying to move Bitcoin or Ether through THORChain cannot get through, whether an honest user or an attacker.

Elliptic tally: 44 percent of the Binance loot frozen

Analytics firm Elliptic counts $6.43 billion in stolen assets, The Block reports. Of that, $2.85 billion has been frozen or seized, or about 44 percent. Stablecoins, which their issuer can block centrally, make up 94 percent of the frozen amount.

On Bitcoin, the XRP Ledger, Solana and NEAR, by contrast, nothing has been frozen. Around $3.25 billion sits in assets that no issuer can stop, including 18,327 BTC and 233 million XRP. According to Mempool.space data, the 19 Bitcoin addresses on the FBI list still hold all 18,270 BTC. For the Bitcoin price, that remains an overhang: if these coins are moved through a swap service, selling pressure may follow. You can find more on the market situation in our Bitcoin price prediction. Bitcoin traded at around $78,600 on Monday morning, up 1.2 percent in 24 hours.

RUNE price: down 18 percent after the trading halt

RUNE is the bond that node operators post and also the unit of account in THORChain's liquidity pools. On Monday morning it traded at $0.507, or 0.454 euros. Over 24 hours the range ran from $0.498 to $0.649, a loss of 18.4 percent. Over 30 days RUNE has lost almost 32 percent. That leaves the price more than 97 percent below its all-time high of $20.87 from May 2021. All price data comes from CoinGecko.

The pause also removes the swap fees on the large networks, which fund the returns of the liquidity pools and the node operators. It is also unclear how THORChain will respond to the FBI's request.

Partial restart: Avalanche, Base and the XRP Ledger are running again

According to the notice reported by TechFlow, trading has resumed on Avalanche, Base, the XRP Ledger and RUNE's own network. Ethereum, Bitcoin and Solana remain blocked. For users, this has a practical consequence: swapping Bitcoin into Ether or vice versa through THORChain is not possible at the moment. Some wallets and swap interfaces use THORChain as a route in the background without showing the name prominently on screen.

Before any cross-chain swap, check in your wallet which service the route runs through and whether the destination network is open. The overview in our software wallet comparison shows which wallets offer built-in swap functions. If a route runs over a paused network, it is better not to start the swap at all.

Tainted coins: anti-money laundering checks on deposits

For investors in Germany, laundering through swap services is not a distant issue. Crypto service providers authorised under the EU's MiCA regulation must check where incoming coins come from under the German Money Laundering Act. They use analytics tools that match addresses against blocklists. Coins that have demonstrably passed through addresses on the FBI list may be flagged on deposit and held until the exchange has established where they came from.

The risk mainly affects anyone who accepts coins from an unknown source: in a private sale, through an anonymous swap service or as a payment from strangers. Keep records of such transactions, meaning transaction ID, date, amount and counterparty. Submit these documents if your exchange asks. You can find a regulated exchange in our overview of regulated crypto exchanges.

The Travel Rule for transfers between exchanges

Since the end of 2024, the so-called Travel Rule has applied to crypto transfers in the EU. It requires providers to send details of the sender and recipient along with transfers. For transfers to and from a self-custody wallet, many exchanges therefore ask whether the address belongs to you. Providing these details in full speeds up the check.

Buying and holding RUNE: MiCA, holding period, leverage and custody

If you are considering RUNE after the price slide, go through the usual points. Only buy from a provider listed as a crypto-asset service provider under MiCA in the register of the EU securities regulator ESMA. The transitional periods for providers without authorisation expired across the EU by July 1, 2026 at the latest. Whether a provider lists RUNE at all varies from exchange to exchange.

For tax purposes, current German income tax law sets a holding period of one year: if you sell RUNE after more than twelve months, the gain is tax-free. Within that period, gains up to an exemption limit of 1,000 euros a year are tax-free, and above it they are fully taxable. Losses from private sales can be offset against gains of the same type.

Caution is needed with leveraged products on RUNE. A liquidation is the forced closure of a leveraged position once the posted collateral is no longer sufficient. RUNE recently fell by around 23 percent from high to low within 24 hours. A long position with three times leverage would have lost around 69 percent of its collateral, and with five times leverage it would have been wiped out entirely.

On custody: RUNE lives on THORChain's own network, not on Ethereum. Before a withdrawal, check whether your wallet supports this network. For larger amounts, a hardware wallet protects better against attacks on your computer than a pure software wallet.

RUNE price levels: $0.50 below, $0.65 above

The level to the downside is the 24-hour low of $0.498, just under $0.50. A close below it would mark a new low. To the upside, the 24-hour high of $0.649 counts, around 28 percent above the current price. Both levels are derived from CoinGecko price data. Beyond the chart, the price hinges on two open questions: when THORChain reopens Bitcoin and Ether, and how the protocol handles the FBI list.

For the Ether price, the situation remains a sideshow. Ether rose 1.9 percent to around $2,307 on Monday morning. According to the FBI, the attackers mainly hold Ether, but a quick sale of large amounts through THORChain is blocked for now.

THORChain halt: Bitcoin and Ether swaps stay frozen until the restart

1. Check the route: Before every swap, look up in your wallet which service it runs through, and do not start a swap on a paused network. You can find suitable wallets in our software wallet comparison.
2. Document the source: Do not accept coins from an unclear source, and keep transaction records. Buy from a provider with MiCA authorisation from our list of regulated crypto exchanges.
3. Store safely: Larger holdings belong on your own hardware wallet. You can compare models and prices in our hardware wallet comparison.

(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)