Uneasy Money, from Unchained: Taylor Monahan on how a one-block reorg made THORChain double spend, and why its node operators may face legal risk after the FBI named them.
Thorchain double spent immediately during the hack. The hack, well, sorry, the hack happened. They start laundering the funds through Thorchain, of course, right?
Thorchain somehow double spent, meaning Thorchain paid out because there was a one block reorg on Ethereum.
I just want to emphasize like, I'm sorry, what?
That is, your protocol is so janky, bro. What the fuck? Like this is a core thing. Like you have to process the swaps.
Uncle said And if there's
Uncles. What about uncles?
I'm sorry, what? So anyway, so Thorchain, this happened, this happened. Luckily for Thorchain, they double spent to a person who's like a a Thorchain cult member or whatever, so he returned the money. But that doesn't fix the underlying bug because like spoiler, there's there's little one block, two block reorgs that happened constantly.
So they had to turn off and then they had to push an update. And here's where it gets really nasty.
And I'm I'm going to be just super blunt about this. Like this is nasty shit. This is we are very firmly the US feds are have set them up like hook line and sinker and Thorchain has taken it.
Wow.
They shut down on Friday because of this reorg. So because of the protocol problem, they literally shut down the protocol. Or most, I guess there was a couple chains that were still on, but like the whole thing was basically off.
In order to turn back on, they had to update the code that the Thor nodes run, uh, to fix the bug, right? Because you can't just have like double spends going through left, right and center, right? The protocol is going to lose money. That's dangerous. That's bad. So fix that.
Especially once someone sees that it's a thing that can happen, right? That becomes the next exploit vector.
Yeah, absolutely people are like, wait a second, I didn't realize this could, yeah, yeah, yeah.
Especially with the volume being hurled. I mean, just freaking guys, the laundry on this is like nothing anyone has ever seen. It is faster, it is harder. The, I think there's like already like 50,000 addresses. Like it is a wild amount.
Do you think Do you think that they my my sense from the timeline is that like they stumbled across this like eight days before as in like realizing that they'd be able to take over the control infrastructure. Yeah, yeah, yeah. Sorry, like as in North Korea.
October 20th or something, right? Was like the timeline. No, so we have on chain going to October 8th.
Okay. So, but like that's not, surely that's not enough time to like get your laundering
No, no, they were, they were also still laundering Bitget. Right. Done during Bitget. Bitget happened like three weeks ago, four weeks ago now. Five weeks ago maybe. Yeah. So.
So their laundry, their laundry was already cranking when this happened.
Yeah, they just started bringing in, it seems like they found some new guys who are using like some really crazy automated scripts. Like, and we've seen them script stuff before, but not to this level.
This then is Claude. Yeah.
So, there's a human in the loop, but there's, well, yeah, I think there's a Claude in the loop as well. Maybe not literally Claude, but one of them.
No. Probably obliterated uh GLM.
Yeah. There's just a lot going on. So this is where it gets nasty for Thorchain though is like
So they're turned off, okay? They have to do a distribution to fix the vulnerability. During this time, Thorchain is not processing any stolen funds.
During this time over the weekend, the FBI, IRS CI, US Secret Service release a formal statement attributing the hack to Trader Traitor, which is North Korea. It's a specific set
can I just say like a a minor aside here? Who in, we should ask our friend, but who gets to decide these names?
Trader Traitor? Um, Trader Traitor, they're all security researchers. Trader Traitor is a really old name. I don't know who decided it, but it was back when um, they originally would always hack people through these malicious trading applications. So they would get the centralized exchange operators to run these applications. And so it's like a funny little pun. You get it? Trader Traitor. It's traitor, like a on chain traitor. And then you get, you know, betrayed traitor.
See, we're so clever.
But like Lazarus, like
Yeah, that Lazarus is security researchers as well. Like it's the security community that name, you get to name. If you find, if you find and organize and collect all the Intel around a new campaign or a new threat group or a sub threat, right? If you do, if your work is good enough, you get to pick their name.
You get to pick their name. It's like naming a star. If you find a star, if you discover a star, you get to name it.
But I do wonder whatever you want. But I do wonder what they think about this like internally, right? Like those teams, like they must have their own teams, surely. Like their own team names.
It's actually funny our friend ask, he he calls them Trader trader too, but he doesn't know anything.
Yeah, that's what's that's what's crazy is like internally, like it's like a meme now where like he knows the name of them based on the external
But he knows Yeah. He's different though. He's in a different group and he kind of
He's in a different group. He's in the like shitty sno no, sorry man. I haven't talked to him in a while.
He's in the one that has a Taylor name. Yeah, yeah.
Yeah, I don't think anyone from trader trader talks to me so.
No, but they all kind of look up to Trader Traitor. Those are like the big boys. They're like the serious OGs. like It's really, it's fascinating. The culture is like just impeccable. Okay, so,
back in Thor chain. Okay.
Who, are we ready? This is so bad.
Halloween, Saturday, FBI attributes formally to Trader Traitor.
Big fancy statement, puts addresses out there, and they explicitly call out the Thor nodes as the first party in the how you can help section.
They explicitly ask the Thor nodes and then like RPC guys, whatever their name for sexes is, uh, Vasps, right? This like the swappers, whatever, they name all these different parties that are going to be having funds go to them. But the first one on the list
The FBI asks, asks Thorchain for help? Do you guys browse around here?
They ask Thor nodes to block. They literally ask Thor node operators to block the transactions involving assets.
the involving these stolen assets. and then
which doesn't sound like something Thorchain is inclined to comply with.
I mean, absolutely not. So, um, but they they they made a very explicit request. So that's that's some nasty work, okay?
You know, we like feds when they're helping us on hacks, but like when they're specifically calling you out by name, this is not and it's not all the other ones are like, yeah, also if you run like a centralized service or I don't know
Be aware. Yeah.
Yeah, no Thor nodes, capital T H O R N like they were like full bore.
Okay, so then the next thing that happens is, and this is just all foreshadowing for what's coming in the pipeline guys, okay? So the next thing that happens is that all the Thor node operators and all the Thor node builders comment on this article and basically say like, we can't do anything, which is a really bad plan because the whole
purpose of this attribution thing, right? is to put everyone on notice that these addresses and these stolen funds are North Korea and that makes them fucking sanctioned. Okay, they are sanctioned as hell. This is an OFAC thing, this is criminal liability. This is not regulators anymore, right?
It's DOJ shit, right? Like you're now like at the top of the the three-letter chain. Yeah.
Okay? And the thing about OFAC and sanctions law is that it actually makes a huge difference whether you know versus not knowing.
And so now they've formally attributed, they've said it's DPRK, they've explicitly called out Thor node operators. The Thor node operators have read this thing and acknowledged that they've read this thing because they are incessantly talking about it on the fucking timeline and on fucking podcast and in the fucking discord in fucking public. The next thing that they do is they do a private distribution for the new updated Thor node that they released to all the Thor nodes. The Thor nodes then vote to turn the network back on, and in doing so, they process transactions that were involving addresses that were explicitly on the FBI's list.
uh, and now it's turned back on and it's like, they've already done like almost $200 million in volume for DPRK.
in like a few days. It's crazy. What's going to happen next, guys? I don't know.
But, uh, I'm fucking over our builders going to prison.
They're, uh, dude, like talk about commitment to the bit. They're extremely committed to this bit. Like
I I have such disrespect for Thor Chain. I hate them. I think their shit is jank like I have so many different problems with them. But at the end of the day, I do not want to see builders going to prison. Period. End of conversation. They don't belong in prison.
You got it was a warning shot. It was such a loud warning shot. It was the same warning shot that they shot in 2022 when Ronin got hacked, right? And we learned our fucking lesson and it's so, it is so painful to me because it's like watching, it's like watching the same slow motion train wreck again.
You know, and we're not even, Roman is still sitting here waiting for his next fucking trial.
Yeah, it's not, it's not good.
And that was way Tornado Cash was this is like if if it's like if Roman Roman and Alexi were like like Ronin gets hacked. The FBI is like, this is DPRK, don't touch these addresses. and then they updated tornado cash. Like the Yeah. Yeah. to to who explicitly let the Ronin funds go through.
Like we would be done with that case. It's crazy.
It's crazy. It's crazy. It's crazy. It's so crazy.
There there's a level of delusionalness that, as I said, like they're committed to the bit of like, no, no, no, we can't do anything and therefore we can do anything that we want because of this we can't do anything. And the problem is, you know, as we saw with fucking Tornado, like they got Alexi's phone clearly. Like we don't know exactly where those fucking signal chats came from, right? But then they just screenshot the like thing where the guy's like, holy shit.
one bad line, yeah.
But it's not even a bad line. You know in context that it was like, holy shit, like we should like we should stop this, right? And then and they make it out like it was like, ah, fuck these guys. We're not going to do shit. And it was like, no, no, that's not what the message was saying and you know it. But, you know, in the fucking court of law, you get to put up a screenshot of like the one
100%.
cropped out. One line of like
the rest of the lines. They don't have to put the rest up. They can do whatever the fuck they want. So.
And I'll just say the lines for this are way they're so much worse. Free Roman Storm hashtag like I don't I genuinely for all the issues I have with Thor chain and their decisions and like every I just disagree with them so vehemonly. I do I still do not want to see our builders.
on their way to going. It's a bad precedent, right? Like, it's a bad precedent to to be even fucking getting close to this thing.
Yeah. If you enjoyed this segment, make sure you tune in at 4:00 p.m. Eastern every Wednesday, where we have much more content like this.
