The incident began on October 31 at 11:34 UTC, when Ethereum replaced a recently produced block containing a 10 ETH deposit that THORChain had already credited. The protocol subsequently refunded funds that its vault had never received, triggering an automatic solvency alert and a broader suspension of cross-chain trading.
THORChain confirmed that the recipient returned the additional 10 ETH, restoring the affected vault’s balance. However, the underlying vulnerability remained under investigation, with node operators retaining responsibility for determining when affected networks could resume trading.
How Did an Ethereum Reorganization Trigger the Refund Bug?
The problem originated in the interaction between Ethereum’s transaction confirmation process and THORChain’s cross-chain accounting system.
During the one-block reorganization, a deposit that THORChain had already recognized was removed from Ethereum’s accepted transaction history. Because the associated swap failed to satisfy the sender’s price limit, the protocol initiated a refund.
THORChain subsequently paid out 10 ETH even though the corresponding deposit no longer existed on Ethereum’s canonical chain. The sender’s actual funds were also returned, leaving the vault with a 10 ETH shortfall.
The protocol said its nodes detected the reorganization, but the verification process failed to obtain a definitive response before the deposit was finalized internally.
THORChain’s automatic solvency checker identified the discrepancy and halted Ethereum swaps. Within approximately two minutes, node operators stopped signing outbound Ethereum transactions to prevent further funds from leaving the vaults.
Operators then suspended additional chains as a precaution. In its November 1 update, THORChain listed Bitcoin, Ethereum, Solana, Tron, BNB Chain, Bitcoin Cash, Dogecoin, Litecoin, Cosmos and Zcash as halted. Trading remained available on Avalanche, Base, XRP Ledger and THORChain’s native network.
The team warned that the vulnerability could be exploited during future reorganizations on supported blockchains, making a permanent correction necessary before normal operations resume.
Investor Takeaway
The automatic safeguards limited the immediate loss to 10 ETH, but the incident exposed a transaction-verification weakness affecting multiple networks.
How Did the Shutdown Affect Binance Hackers?
The suspension had an unintended consequence for attackers attempting to move proceeds from Binance’s October 29 security breach, which the exchange estimated had affected approximately $6.3 billion in cryptocurrency.
Chainalysis said the emergency pause prevented users, including North Korean-linked money launderers, from accessing most of THORChain’s cross-chain swapping services.
The interruption temporarily restricted one route through which the attackers could convert stolen assets between blockchains. However, it did not freeze the stolen funds themselves or prevent transfers through other available protocols.
The attackers had already been moving cryptocurrency across multiple networks. According to on-chain analysis of the Binance attackers’ Tron activity, approximately $242 million had moved through Tron and associated cross-chain services within two days of the breach.
Those transfers involved several protocols and should not be interpreted as funds exclusively processed through THORChain. Nor does the temporary shutdown establish how much additional laundering was ultimately prevented.
The FBI attributed the Binance theft to North Korea’s TraderTraitor operation on October 31. The agency said the attackers were converting stolen assets primarily into Ethereum before attempting further laundering through decentralized finance and instant-swap services.
Why Is THORChain Facing Pressure Over Stolen Funds?
The FBI specifically urged THORChain node operators, decentralized finance providers and other cryptocurrency infrastructure operators to block transactions connected to addresses associated with the attackers.
That request places renewed attention on THORChain’s permissionless operating model. The protocol has maintained that its infrastructure should process transactions without selectively excluding participants based on external demands.
Founder John-Paul Thorbjornsen defended that position following the Binance attack, arguing that shutting down the protocol in response to external pressure would undermine its role as neutral settlement infrastructure.
The October 31 suspension was different. It resulted from an internal security vulnerability rather than a decision to block specific wallet addresses.
The distinction matters operationally. Node operators demonstrated their ability to suspend entire networks to protect protocol solvency, but that does not establish that they have agreed to screen and reject individual transactions associated with illicit activity.
Investor Takeaway
The shutdown restricted suspected laundering without targeted address blocking, exposing the tension between permissionless settlement and law-enforcement demands.
What Must THORChain Fix Before Trading Resumes?
THORChain’s immediate priority is correcting the refund-verification process to prevent deposits removed during blockchain reorganizations from being treated as valid transactions.
The current incident follows THORChain’s recovery from a $10.7 million exploit earlier in 2026, which forced a prolonged trading suspension before services resumed in June.
Unlike that earlier attack, the latest incident did not result in a confirmed permanent loss after the recipient returned the additional ETH. Nevertheless, it demonstrated that even a relatively small accounting discrepancy can force widespread disruption when the underlying vulnerability affects cross-chain settlement.
THORChain said core developers were preparing the necessary fixes and that node operators would independently assess when affected chains were safe to reopen.
The next operational test is whether those corrections can prevent repeated refunds without introducing unacceptable settlement delays. For liquidity providers and users, the timing of restored swaps and the reliability of transaction verification matter more immediately than the unintended interruption to the Binance attackers’ fund movements.
