- An Ethereum block reorganisation triggered a double-refund glitch on THORChain, halting swaps across 12 of 13 networks
- Chainalysis confirmed the accidental pause “inadvertently delayed the laundering” of significant Binance hack funds
- The FBI had already asked THORChain node operators to voluntarily block transactions linked to the attack
- THORChain co-founder Chad Barraford noted all operator activity is publicly visible on-chain, aiding investigations
An unexpected Ethereum blockchain reorganisation on Saturday accidentally jammed a key laundering route for Binance hack proceeds, halting THORChain’s cross-chain swap service for several hours, according to blockchain analytics firm Chainalysis.
How The Glitch Happened
When Ethereum reorganised a single block, a 10 ETH deposit to a THORChain vault was recorded on the discarded chain but never settled on the main network. THORChain had already credited the deposit. When the associated swap failed to meet its price conditions, the protocol issued a refund.
On October 31, THORChain halted trading on several blockchains.
An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators halted ETH transaction signing, so no further ETH could leave the vaults.
Node operators then halted all chains as a precaution so core developers could investigate.
The 10 ETH has been returned by the user to make the vault solvent again.
Breakdown of what happened and next steps:
At 11:34 UTC Oct 31, Ethereum had a one-block reorg. A 10 ETH deposit to one of the vaults sat in the dropped block and never landed on the canonical chain.
THORChain had already observed and credited that deposit. The swap missed its price limit and was refunded, so the vault paid out 10 ETH it never received. The sender’s real deposit was refunded as well.
Every node detected the reorg. But the re-check that should have removed the deposit could not get a clear answer in time, so it was finalized.
The solvency checker halted ETH swapping automatically, then three node votes halted all ETH outbound payments.
All chains were then halted by three node votes as a precaution. Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.
Note: Three node votes can trigger emergency halts to protect network solvency. However, that action can be reversed by four counter node votes, then five node votes can reverse the reversal, and so on, maintaining a balance between decentralization and rapid emergency intervention. Halting a chain does not give those nodes control of the assets.
Core developers have been working on the necessary fixes.
Nodes will decide to re-enable chains as they are deemed safe.
Trading blockchains: AVAX, BASE, RUNE, XRPL
Halted blockchains: ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC
— THORChain (@THORChain) November 1, 2026
A second linked deposit was also refunded, leaving the vault approximately 10 ETH short. THORChain’s automatic solvency protection kicked in immediately, halting all Ethereum processing and suspending trading across 12 of its 13 supported external networks.
Laundering Route Blocked By Accident
Chainalysis confirmed the malfunction “inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” as North Korean-linked hackers had been using THORChain to convert stolen assets across chains.
THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.
The reason? An Ethereum reorg.
One happened this morning and caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH.
This triggered an “emergency pause” on THORChain, preventing all users, including DPRK’s money launderers, from using cross-chain swaps.
Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.
— Chainalysis (@chainalysis) October 31, 2026
The FBI had already issued a voluntary alert on October 31 asking THORChain node operators to block transactions linked to TraderTraitor-controlled addresses. The accidental pause effectively achieved what the FBI had requested, at least temporarily.
Recovery & Cooperation With Law Enforcement
Service was restored chain by chain within hours, and developers outlined plans to update THORChain’s observation and finalization procedures to prevent recurrence.
THORChain co-founder Chad Barraford noted that all operator activity is publicly visible on the blockchain, stating: “No subpoenas required, a best-case scenario for investigations.”
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment