THORChain has switched cross-chain trading back on across 11 blockchains after operators began installing node software version 3.21.1, though three networks remain frozen and the protocol says every active node must upgrade before swap performance issues are resolved.
The decentralized liquidity protocol said trading for its native RUNE token is live again alongside swaps involving Avalanche (AVAX), Base (BASE), Bitcoin (BTC), Bitcoin Cash (BCH), Dogecoin (DOGE), Ethereum (ETH), Litecoin (LTC), Tron (TRX), the XRP Ledger (XRP) and Zcash (ZEC). Outbound signing has been re-enabled on all 10 external chains that came back online, which is what allows the protocol to settle trades rather than merely quote them.
Solana, BNB Chain and Cosmos remain shut. The protocol has not given a timetable for their return, saying only that those networks need further updates and that node operators must finish upgrading first. Historical node data suggests activity on Cosmos and Solana was already constrained before the latest outage: Solana swaps had been paused for technical reasons while the network waited for a suitable software release, and version 3.21 was meant to restore them.
Public node data showed 103 of 111 active nodes running 3.21.1 as of 10:12 UTC, leaving eight operators on the previous build, according to a protocol post on X. THORChain has stressed that all active nodes need the update "to fix performance issues with swapping."
Note: Outbound signing has been re-enabled for all 10 external chains that reopened; the three halted networks cannot sign or settle transactions.
A private binary and a security-focused patch
Version 3.21.1 ships as a Bifrost-only private binary carrying extra security patches, and operators have been told not to build from source. There is no fixed upgrade height, so each operator must install the release manually. Bifrost is the middleware layer that watches and signs transactions on connected blockchains, making it the component that actually moves value between networks.
The release does not alter network consensus. Its changes include fixes for XRP Ledger timeouts, batched queries of Tron blocks, and a revised way of processing Ethereum receipts through a single call to eth_getBlockReceipts. The patch also sets a minimum relay fee for Bitcoin and removes the GAIA IBC deposit monitor.
One change ties Bifrost's solvency signal directly to the network's halt state, a safety link intended to freeze activity automatically when vault balances no longer match what they should hold. THORChain said the update "gets THORChain one step closer to launching Monero," the privacy-focused cryptocurrency that sits on the protocol's longer-term roadmap.
How the outage began
The suspension traces back to October 31, when a user's deposit vanished from Ethereum's history during a block reorganization. THORChain had already refunded 10 ETH from one of its vaults for a deposit it never received, and the automated solvency checker flagged the shortfall. Swaps were halted on 10 of the 13 chains the protocol connects.
Restoration came in stages. Bitcoin swaps returned at 17:08 UTC on November 3, with Ether and Tron following by 19:58 UTC. The user who received the 10 ETH has since returned the funds to the protocol's vault.
The halt coincided with a separate request from the FBI, which on October 31 asked THORChain node operators and other DeFi services to block wallets tied to a $6.3 billion Binance hack two days earlier. The bureau attributed the theft to TraderTraitor, a collective it links to North Korea, and published 628 related addresses: 608 on Ethereum, 19 on Bitcoin and one on Solana. The list contained no Tron addresses, even though Tron has been a heavily used route for moving the stolen funds.
THORChain's official website blocked the flagged addresses at the front end, but the protocol's decentralized design means the site is only one gateway. Technical co-founder Chad Barraford told The Block that independent node operators could still process trades outside any central control, and he said he did not expect them to stop trading on the bureau's request. Barraford also noted that coordinating a supermajority of operators around a blocklist could take days or weeks, which makes near-instant intervention impractical without ceding authority to a central party.
Analyst estimates cited in reporting on the laundering flow put roughly $242 million through Tron in two days, with about $140 million moving across cross-chain services. Relay accounted for close to $48 million, THORChain about $44 million, Chainflip $32.1 million and Symbiosis $16 million. No evidence has emerged that THORChain or its operators knowingly handled funds for the attackers.
What it means for users and the wider market
The immediate read-through for traders is that RUNE liquidity is functioning again on most major routes, but the three missing networks cover a meaningful share of retail flow, particularly BNB Chain and Solana. Until those return, cross-chain routes that depend on them will price wider or fail outright, and arbitrage between the affected venues and the rest of the market will stay impaired.
The upgrade also lands against a compliance backdrop that is awkward for every decentralized exchange. Front-end blocking satisfies the letter of an enforcement request without touching the underlying protocol, and the gap between the two is exactly where regulators and investigators have focused since the Binance theft. For THORChain, the solvency-linked halt introduced in 3.21.1 cuts the other way: it hardens the protocol against accounting failures but gives it one more automatic trigger that can take trading offline.
Node operators who have not yet moved to 3.21.1 now hold the remaining three chains hostage to their upgrade timing. The protocol's own guidance is unambiguous that the fix requires full participation, which puts the return of Solana, BNB Chain and Cosmos in the hands of eight lagging operators rather than any central schedule.
