🧨 Thorchain's bug froze swaps just as the FBI asks nodes to block Binance hack money
The Binance loot, the one North Korea's Tradertraitor lifted on Oct. 29, was supposed to get washed through Thorchain. Then one reorged Ethereum block conjured 10 ETH out of thin air, and Thorchain hit the emergency brake on most of its routes. The launderers got locked out along with everyone else. Poetic, honestly. Somebody up there has a sense of humor, and it's not us.
▪️ Ethereum reorganized a single block and erased a 10 ETH deposit meant for a Thorchain vault. That deposit never made it back onto the canonical chain. Ghost money: it exists right up until it doesn't.
▪️ Thorchain's observers had already seen the deposit and credited the vault. The linked swap failed its price conditions, so the protocol refunded 10 ETH the vault never actually received.
▪️ Another deposit from the same wallet was refunded too, leaving the vault about 10 ETH short. Solvency protections kicked in and halted Ethereum processing.
▪️ Trading and new swaps stopped on 12 of 13 supported external networks. Some previously initiated outbound payments kept running.
▪️ No malicious intent was found. The cause was a collision between Ethereum's reorg and Thorchain's deposit verification procedures. Nobody did it on purpose, and that's the scary part.
▪️ On Oct. 31 the FBI, with the U.S. Secret Service and IRS Criminal Investigation, asked infrastructure providers to block wallets tied to the Binance theft.
💬 «No subpoenas required, a best-case scenario for investigations.» — Chad Barraford
🔮Launderers got stuck behind a bug, not a sanction. Next time the bug might come with a federal request attached. Enjoy the ride, hamsters.
@rmpltg
The Binance loot, the one North Korea's Tradertraitor lifted on Oct. 29, was supposed to get washed through Thorchain. Then one reorged Ethereum block conjured 10 ETH out of thin air, and Thorchain hit the emergency brake on most of its routes. The launderers got locked out along with everyone else. Poetic, honestly. Somebody up there has a sense of humor, and it's not us.
▪️ Ethereum reorganized a single block and erased a 10 ETH deposit meant for a Thorchain vault. That deposit never made it back onto the canonical chain. Ghost money: it exists right up until it doesn't.
▪️ Thorchain's observers had already seen the deposit and credited the vault. The linked swap failed its price conditions, so the protocol refunded 10 ETH the vault never actually received.
▪️ Another deposit from the same wallet was refunded too, leaving the vault about 10 ETH short. Solvency protections kicked in and halted Ethereum processing.
▪️ Trading and new swaps stopped on 12 of 13 supported external networks. Some previously initiated outbound payments kept running.
▪️ No malicious intent was found. The cause was a collision between Ethereum's reorg and Thorchain's deposit verification procedures. Nobody did it on purpose, and that's the scary part.
▪️ On Oct. 31 the FBI, with the U.S. Secret Service and IRS Criminal Investigation, asked infrastructure providers to block wallets tied to the Binance theft.
The FBI request is voluntary, not a court order, but it drops a permissionless protocol right in the crosshairs, and Thorchain operators have pushed back on selective transaction blocking before. The pause was an accounting fix, not a targeted freeze on Binance money, and developers are still digging into the malfunction. For anyone trading cross-chain routes, the takeaway is blunt: one reorged block on Ethereum can take a bridge offline across most of its networks overnight. Your 'instant swap' is only as instant as the weakest reorg.
💬 «No subpoenas required, a best-case scenario for investigations.» — Chad Barraford
🔮
@rmpltg
🚨 SEC sues BG Wealth and DSJ Exchange: $130M from retail on paperwork that looked official
The SEC filed a civil complaint against BG Wealth Sharing and DSJ Exchange. Allegedly they raised more than $130 million from tens of thousands of retail investors. The pitch: crypto trading signals and risk-free returns, backed by filings that looked like government approval. The complaint was filed October 29, detailed in an October 30 litigation release.
▪️ The product was an investment program built on purported crypto trading signals, sold with promises of extraordinary, risk-free returns. Sound familiar? It's the oldest trick in the book.
▪️ The sales tool was false Form ADV and Form D filings, presented as proof of legitimacy. A link to an SEC database makes a pitch look official. It doesn't mean anyone approved it.
▪️ The SEC says neither entity was registered with it. The disputed filings have since been removed from the Commission's website. Nice try, but the screenshots are still floating around the chats.
▪️ The SEC is seeking injunctions, disgorgement and civil penalties.
▪️ Heads up: these are allegations in civil proceedings. No final court finding, criminal conviction or confirmed investor recovery amount exists yet. Nobody's getting paid today.
📊 Complaint filed:
🔮Tens of thousands of people saw a government database link and wired money anyway. Who sold them the 'verified' part?
@rmpltg
The SEC filed a civil complaint against BG Wealth Sharing and DSJ Exchange. Allegedly they raised more than $130 million from tens of thousands of retail investors. The pitch: crypto trading signals and risk-free returns, backed by filings that looked like government approval. The complaint was filed October 29, detailed in an October 30 litigation release.
▪️ The product was an investment program built on purported crypto trading signals, sold with promises of extraordinary, risk-free returns. Sound familiar? It's the oldest trick in the book.
▪️ The sales tool was false Form ADV and Form D filings, presented as proof of legitimacy. A link to an SEC database makes a pitch look official. It doesn't mean anyone approved it.
▪️ The SEC says neither entity was registered with it. The disputed filings have since been removed from the Commission's website. Nice try, but the screenshots are still floating around the chats.
▪️ The SEC is seeking injunctions, disgorgement and civil penalties.
▪️ Heads up: these are allegations in civil proceedings. No final court finding, criminal conviction or confirmed investor recovery amount exists yet. Nobody's getting paid today.
📊 Complaint filed:
October 29If you or someone you know bought into this program, the money is not back yet and nothing is confirmed. Disgorgement only matters if the SEC can find and freeze the assets, and that takes time most victims don't have. Next up: asset tracing and the court calendar, not a payout. The lesson is cheap and old: a logo, a filing number or a 'verified' badge tells you nothing about who holds your cash. Stop buying the badge.
🔮
@rmpltg
🎰 $1.07B in Crypto Walked Into Sihanoukville Casinos Right Under OFAC's Nose
Thirty-four casinos in Sihanoukville, Cambodia pulled in about $1.07 billion in crypto between January 1 and September 7, 2026, according to blockchain firm TRM Labs. Casinos tied to OFAC-designated networks got $687 million of it, 64% of the total. Sanctions, huh. Nice speed bump.
▪️ Entities linked to Xihu Resort Hotel took in $184M from April 23 to September 7, months after the US designations.
▪️ Entities attributed to Huan Hai Bo Lai International Investment pulled another $129M over the same stretch.
▪️ A casino tied to Jin Bei Group still got $9M after the October 2025 designation of Prince Group and related entities.
▪️ Monthly inflows look smaller: about $148M a month from January to May, then roughly $95M in July and August. Designated casinos dropped from $100M to about $48M a month.
▪️ TRM isn't buying the dip. Operators keep rotating wallet addresses, so some money may be moving through wallets investigators haven't identified yet.
▪️ Almost all of it is USDT on TRON. TRM credits low fees, deep liquidity and wide adoption across Southeast Asia. Of course it does. Cheap, fast, and nobody checks your ID at the door.
📊 Total crypto received, Jan 1 to Sep 7, 2026:
📊 Tied to OFAC-designated networks:
📊 Xihu Resort Hotel-linked, Apr 23 to Sep 7:
📊 Huan Hai Bo Lai-linked, same period:
🔮Sanctions pulled the menu off the wall, the kitchen's still cooking. Which wallet cluster is TRM not naming yet?
@rmpltg
Thirty-four casinos in Sihanoukville, Cambodia pulled in about $1.07 billion in crypto between January 1 and September 7, 2026, according to blockchain firm TRM Labs. Casinos tied to OFAC-designated networks got $687 million of it, 64% of the total. Sanctions, huh. Nice speed bump.
▪️ Entities linked to Xihu Resort Hotel took in $184M from April 23 to September 7, months after the US designations.
▪️ Entities attributed to Huan Hai Bo Lai International Investment pulled another $129M over the same stretch.
▪️ A casino tied to Jin Bei Group still got $9M after the October 2025 designation of Prince Group and related entities.
▪️ Monthly inflows look smaller: about $148M a month from January to May, then roughly $95M in July and August. Designated casinos dropped from $100M to about $48M a month.
▪️ TRM isn't buying the dip. Operators keep rotating wallet addresses, so some money may be moving through wallets investigators haven't identified yet.
▪️ Almost all of it is USDT on TRON. TRM credits low fees, deep liquidity and wide adoption across Southeast Asia. Of course it does. Cheap, fast, and nobody checks your ID at the door.
📊 Total crypto received, Jan 1 to Sep 7, 2026:
$1.07B📊 Tied to OFAC-designated networks:
$687M (64%)📊 Xihu Resort Hotel-linked, Apr 23 to Sep 7:
$184M📊 Huan Hai Bo Lai-linked, same period:
$129MSanctions on paper aren't sanctions on the money. If you trade USDT or follow TRON flows, this is the rail still carrying scam-compound cash, and the enforcement headlines aren't cutting it off. Kok An, a Cambodian senator, plus 28 related people and entities, got sanctioned in April 2026 over scam centers that defrauded Americans. The casinos kept taking crypto anyway. September's license purge is the newest move, but the wallet-rotation problem TRM flagged means that monthly drop could be a mirage. Pretty picture on the chart, dirty money underneath.
🔮
@rmpltg