THORChain Glitch Blocks Binance Hack Route as FBI Presses Nodes

A reported glitch on THORChain, the decentralized cross-chain liquidity protocol, interrupted a swap route that investigators had linked to proceeds from the Binance hack, as the FBI stepped up pressure on network node operators to cooperate with the ongoing funds-tracing effort.

TLDR Keypoints

• A technical glitch on THORChain reportedly halted a swap route identified as a laundering path for funds connected to the Binance hack.
• The FBI has reportedly been pressing THORChain node operators to preserve transaction data and assist with the investigation into the stolen funds.
• The disruption is described as a temporary protocol-level failure, not a confirmed freeze or permanent block of the flagged route.

How the THORChain Glitch Interrupted the Reported Binance Hack Route

What reportedly failed and when

The reported glitch affected THORChain’s cross-chain swap infrastructure, creating an outage on a route law enforcement had flagged as active in moving hack-linked funds. Per Bitcoin.com News, the disruption was a protocol-level technical failure rather than a deliberate intervention by developers or node operators. For related coverage, see Wall Street Analysts Back Crypto Stocks After Binance Hack.

Why the route was linked to the Binance hack

The FBI previously confirmed North Korean actors were behind the Binance hack, flagging specific BTC, ETH, and SOL addresses used to move the stolen funds. Investigators identified THORChain as one of the cross-chain venues being used to obscure fund movements, due to its non-custodial, permissionless swap design.

The glitch interrupted that route before any confirmed transfer completed via the flagged path, according to the report. It remains unconfirmed whether the disruption prevented a specific in-progress transaction or simply closed the route temporarily.

FBI Pressure on Nodes and What It Means for the Investigation

What action the FBI reportedly took

The bureau reportedly contacted THORChain node operators directly, urging them to retain transaction logs and cooperate with the investigation. Node operators on THORChain are independent participants who bond RUNE tokens to validate swaps; they are not employees of any company and have no centralized point of contact.

Response from THORChain participants

No formal public response from the THORChain developer community or node operators had been documented at the time of reporting. The decentralized nature of the network means the FBI cannot compel compliance through a single legal entity, a structural feature that has drawn scrutiny given the protocol’s repeated appearance in post-hack fund flows.

On-chain reserve data showed the Binance hack drained wallets backing customer assets, underscoring the scale of the incident investigators are now tracing across multiple DeFi venues.

What the action can and cannot change

Even with node cooperation, THORChain’s architecture limits what logs individual operators hold. Swap data is recorded on-chain and publicly visible, but linking on-chain addresses to real-world identities requires off-chain intelligence the FBI is separately building. The glitch temporarily closed one route but does not prevent actors from attempting swaps via alternative paths once the protocol resumes normal operation.

Binance previously detailed its response to the reported hack, and separately confirmed that ten cryptocurrencies remained fully backed in the aftermath. The FBI’s node outreach represents one of the more direct law-enforcement attempts to engage a decentralized protocol’s infrastructure, with the investigation still active as of the latest available reporting.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.