Analysis4 min read
THORChain stopped trading on 31 October after an Ethereum reorganisation caused the protocol to refund the same 10 ETH deposit twice, and the automated solvency trigger halted the network (CryptoBriefing). Swaps were paused across 12 of the 13 chains the protocol lists (Odaily), and Chainalysis said the halt delayed the laundering of funds stolen from Binance (CryptoBriefing). By 1 November the 10 ETH had been returned, but ten chains, Bitcoin and Ethereum among them, were still halted (BlockchainReporter, Coindoo).
What happened
At 11:34 UTC on 31 October Ethereum had a one-block reorg. A 10 ETH deposit to vault …dx7767 sat in the dropped block and was never re-included on the canonical chain, but THORChain had already observed it, finalised it a few blocks later and credited the vault. The swap failed its price limit and was refunded, so the vault paid out 10 ETH it never received. The real deposit from the same sender was refunded as well, leaving vault …dx7767 10 ETH short and the sending wallet 0xcef5…ee2e about 10 ETH over what it deposited (Tree of Alpha).
Nothing in the sequence suggests intent. The wallet had used THORChain for almost two years and the reorg was chance (Tree of Alpha). Every node detected the reorg within seconds, but the re-check that should have removed the deposit could not get a clear answer at that moment and kept it, and finalisation then went through on the cached observation (Tree of Alpha).
Where it stands
In its 1 November update THORChain said the user had returned the 10 ETH and the vault was solvent again (BlockchainReporter). AVAX, BASE, RUNE and XRPL were trading, three chains having been re-enabled since the evening of 31 October, while ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC remained halted (Coindoo, BlockchainReporter). THORChain gave no reopening date: node operators will decide when each halted chain is safe to re-enable, and core developers are still working on fixes (BlockchainReporter).
The pause was never total. Outbound signing stayed enabled on most affected chains, so payments could still go out while new swaps were blocked (Odaily), though Ethereum signing was halted within about two minutes of the incident (Coindoo). THORChain's documentation distinguishes a trading halt, which stops swaps but still processes outbound payments, from a signing halt, which leaves outbound payments queued (THORChain).
THORChain's own guidance is that funds sent during a halt are in most cases not lost but can be significantly delayed, and that users should not send funds while the network is halted (THORChain). An automatic halt like this runs up to 720 blocks, about 1.5 hours, unless node votes extend it (CryptoBriefing). This time core developers halted all chains as a precaution while they verified the sequence of events (Tree of Alpha).
The Binance connection
Chainalysis said the pause inadvertently slowed the laundering of a large amount of funds stolen from Binance, and tied the activity to North Korean actors: the emergency pause blocked most cross-chain swap routes for everyone, suspected North Korean launderers included (Odaily, Bitcoin.com). The pause was triggered by the reorg and the double refund, not by any deliberate move against the stolen funds; the delay landed on that activity by coincidence (CryptoBriefing).
On 31 October the FBI, the Secret Service and IRS Criminal Investigation asked crypto infrastructure providers to block transactions involving wallets tied to the Binance theft, and named THORNode operators directly alongside RPC operators, instant exchanges and DeFi services (Coindoo). It is a request, not a sanctions designation or a court order (Coindoo, Bitcoin.com). THORChain technical co-founder Chad Barraford replied on X that the information operators hold is publicly accessible: "No subpoenas required, a best-case scenario for investigations" (Bitcoin.com). After the Bitget hack, Barraford argued that THORChain's validators halt for losses to the protocol itself, not for outside thefts (Alphaday).
This was not the protocol's first operational halt of 2026. Earlier in the year it dealt with exploits and with halts linked to Zcash and Tron (CryptoBriefing).
What to watch
- The ten halted chains, including Bitcoin and Ethereum, had no reopening date as of 1 November; node operators re-enable each one when they judge it safe (BlockchainReporter).
- The core team had said ETH would stay halted on vault …dx7767 until the 10 ETH was recovered or written off (Tree of Alpha). It has been returned, but ETH was still halted on 1 November (BlockchainReporter).
- The stated fixes: chain-level halts in place of the global pause, and Bifrost and thornode fixes in the next release (Tree of Alpha). Swaps submitted during the halt are held or refunded once the chain resumes (Tree of Alpha).
