THORChain halts swaps on 10 chains, stalling Binance hack laundering
Author: Crypffalo Research · 10:53 02/11/2026
An Ethereum reorg exposed a refund bug that forced THORChain to pause swaps on 10 networks, including Bitcoin, Ethereum and Solana. Chainalysis says the halt is slowing North Korean hackers laundering the $6.3 billion Binance haul.
Cross-chain swap protocol THORChain has paused swaps on 10 networks, including Bitcoin, Ethereum, Solana and Tron. The halt followed a refund bug exposed by an Ethereum block reorganization at 11:34 UTC on Oct 31.
According to Chainalysis, the pause has inadvertently slowed North Korean hackers trying to launder funds from the $6.3 billion Binance hack. As of Nov 2, swaps on ETH, BTC and SOL remained offline.
Key takeaways
- The incident: A one-block Ethereum reorg erased a 10 ETH deposit THORChain had already credited, triggering a double refund.
- Scope: Swaps were halted on 10 networks; AVAX, Base, RUNE and XRPL have since resumed.
- Side effect: Chainalysis says DPRK hackers can't use most of THORChain's bridges while the halt lasts.
- Binance flows: DefiLlama shows about $5.81 billion in 24-hour net outflows, a figure Binance says is inaccurate.
- Status: The user returned the extra 10 ETH and the affected vault is solvent again.
What happened at THORChain
A reorg occurs when a network replaces a recent block with a competing one. The block holding a 10 ETH deposit was dropped, but THORChain had already credited it.
The swap then failed its price limit, so the protocol refunded funds its vault never received. The sender's real deposit was also refunded, creating a 10 ETH overpayment that tripped an automatic pause.
The THORChain team acknowledged the risk now that the bug is public. Every time an external chain reorgs, it said, a malicious actor could send a new transaction with the same nonce and get paid from THORChain vaults.
- 11:34 UTC, Oct 31: Ethereum reorg; ETH swaps pause automatically.
- Afterward: Node operators halt ETH withdrawals and trading on other chains.
- Nov 2: The 10 ETH is returned; AVAX, Base, RUNE and XRPL reopen while ETH, BTC and SOL stay paused.
A key laundering route goes dark
Chainalysis said THORChain "inadvertently delayed the laundering of a significant amount of funds stolen from Binance." Until service returns, neither the hackers nor anyone else can swap through most of the protocol's bridges.
The FBI has attributed the attack to North Korea's TraderTraitor unit. It urged THORChain node operators and DeFi services to block addresses tied to the hack and said the hackers were converting stolen assets into ETH.
THORChain founder John-Paul Thorbjornsen continues to defend the protocol's permissionless design. If nodes took the protocol offline under pressure, he warned, "the experiment is over."
Binance outflows remain in focus
Binance's own update showed about $4.6 billion in withdrawals against $1 billion in deposits, or roughly $3.6 billion in net outflows. DefiLlama data put 24-hour net outflows higher, at about $5.81 billion.
Binance said the DefiLlama figure excludes transfers into its new hot wallet and is not accurate. The exchange said withdrawals have slowed, represent a small share of its roughly $171 billion in assets, and that about 95% of stolen assets have been replaced.
What it means for crypto markets
Bitcoin recovered modestly over the weekend to trade above $78,000 on Monday, while ETH hovered near $2,300 after hitting a two-month low on Friday. Markets have shown little reaction to the THORChain news so far.
- Bull case: A blocked laundering route gives law enforcement and stablecoin issuers more time to trace and freeze stolen funds.
- Risk case: The reorg bug highlights technical risk in cross-chain infrastructure, and renewed Binance outflows could weigh on sentiment.
RUNE rose about 13% after the Binance hack, so the token could see sharp moves once networks reopen.
What to watch next
- When THORChain reopens ETH, BTC and SOL swaps and ships a fix for the reorg bug.
- Fresh Binance net flow data and progress on replacing the remaining 5% of stolen assets.
- FBI address blocklists and how THORChain node operators respond.
- The US midterm election on Nov 3; see the economic calendar and real-time liquidations.
Frequently Asked Questions
Was THORChain hacked?
Not in the usual sense. The protocol overpaid 10 ETH because of how it handled a reorg, and the user has returned the funds.
Why does THORChain matter for the Binance hack?
North Korean hackers have used THORChain for permissionless cross-chain swaps after past attacks. With swaps paused, that route is temporarily closed.
Are Binance users' funds safe?
Binance says it has replaced about 95% of the stolen assets using company funds and is reopening withdrawals in phases.
*This content is for information only and is not financial advice.*
Tags: THORChain, Binance, Hack, North Korea, Ethereum
Related articles
- Binance sees $3.64B net outflows as withdrawals reopen after record hack
- Binance Reopens Withdrawals on 15 Networks, Says 95% of Hacked Assets Restored
- FBI confirms North Korea's TraderTraitor behind $6.4B Binance hack, flags 600+ addresses
- Chainalysis discloses breach, hackers accessed customer names and emails
- Binance replaces 90% of stolen crypto after $6.3B hack, eyes Sunday withdrawals
- Bitcoin ETFs See $643M Outflow, Largest Since June After Binance Hack