TLDR
- THORChain paused swaps on 10 networks, including Bitcoin, Ethereum, Solana and Tron, after an Ethereum reorg exposed a refund bug.
- A 10 ETH deposit was removed by the reorg, and THORChain still refunded it, causing an extra 10 ETH payout.
- Chainalysis said the pause unintentionally delayed North Korean hackers from laundering funds stolen in the $6.3 billion Binance hack.
- The FBI asked THORChain node operators and DeFi services to block addresses tied to the hacking group TraderTraitor.
- Swaps still work on Avalanche, Base and XRP, and nodes will re-enable the other chains once they are judged safe.
THORChain paused swaps on 10 blockchains on Saturday after a bug tied to an Ethereum block reorganization. The pause may have slowed the movement of funds stolen in the Binance hack, according to Chainalysis.
On October 31, THORChain halted trading on several blockchains.
An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators…
— THORChain (@THORChain) November 1, 2026
The affected networks include Bitcoin, Ethereum, Solana and Tron. Swaps are still working on Avalanche, Base and XRP, based on the protocol’s network status page.
What Caused the THORChain Pause
The problem began at 11:34 UTC on Saturday. A one-block reorganization on Ethereum removed a 10 ETH deposit that THORChain had already credited.
A reorg happens when the network replaces a recent block with a competing block. In this case, the deposit vanished from Ethereum’s record.
The swap then failed to meet its price limit, so THORChain issued a refund. That refund was sent against funds the vault never received.
The sender’s actual deposit was also refunded. This created an extra 10 ETH payout and triggered an automatic pause.
THORChain’s team said the flaw could be abused. After a reorg on an outside chain, a bad actor could send a new transaction with the same nonce and be paid by the vaults.
Effect on the Binance Hack Funds
The Binance hack took place on October 29 and involved about $6.3 billion. The FBI linked the attack to the North Korean group TraderTraitor.
Chainalysis said on Sunday that the pause unintentionally delayed the laundering of a large amount of the stolen funds. The firm said the pause stops all users, including North Korean launderers, from using cross-chain swaps.
Chainalysis added that neither the hackers nor anyone else can swap through most THORChain bridges until service returns.
On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions tied to addresses used by TraderTraitor. North Korean hackers have used THORChain to swap crypto after earlier attacks.
THORChain’s RUNE token jumped 13% after the Binance hack was reported. The protocol’s third-quarter report said it kept its neutral, permissionless stance despite pressure to block transactions linked to hacked funds.
Founder John-Paul Thorbjornsen also defended permissionless transactions. He said that if node operators took the protocol offline, “the experiment is over.”
He warned that there would be no other venue for neutral settlement and that the protocol would have failed.
According to the network status page, trading continues on Avalanche, Base and XRP. Node operators will decide when to re-enable the other chains as they are deemed safe.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
