THORChain pauses operations after Ethereum reorg triggers double refund
THORChain halted operations on October 31, 2026, after an Ethereum reorganization triggered a duplicate 10 ETH refund, according to Chainalysis.
The pause had a side effect that matters beyond one refund. According to Chainalysis, the halt was connected to funds stolen from Binance, and it slowed efforts to launder them. The emergency brake activated automatically when the protocol mistakenly issued a duplicate refund on a deposit of 10 ETH.
What happened on the chain
On October 31, 2026, Ethereum went through an unexpected reorganization, usually called a reorg. In technical terms, the network swapped out recently confirmed blocks for a competing chain of blocks. Transactions that looked final could shift, disappear, or show up again in a new position.
For a cross-chain protocol like THORChain that watches Ethereum and responds to deposits, this created a problem. When the history it saw got rewritten, the protocol acted on the same event twice—paying back one 10 ETH deposit two times.
The Binance connection
The emergency halt was connected to funds stolen from Binance, according to Chainalysis. The blockchain analytics firm tied the laundering activity to DPRK actors, meaning groups associated with North Korea. With swaps frozen on 12 chains, anyone trying to push those stolen funds through THORChain had to wait.
Moving assets quickly between chains is a common way to make stolen money harder to trace, so even a brief delay gives investigators more time.
Not THORChain's first halt
This was not the protocol's first operational halt in 2026. Earlier in the year, THORChain dealt with exploits and halts linked to ZEC and TRON. The protocol depends on its native RUNE token to operate as a decentralized liquidity network, allowing cross-chain swaps without centralized exchanges.
Every new chain THORChain adds creates another potential point of failure. An event on one chain, such as an Ethereum reorg, can force a pause across nearly the entire network.
What this means for users
The incident shows both the safety net and its limits for THORChain users. The emergency pause did what it was built to do—catch an anomaly and stop activity before more damage could build up. However, the double refund still went out, meaning the protocol caught the mistake after making it, not before.
This raises questions about cross-chain liquidity protocols' reliability when handling bad data from connected chains, including temporary data later reversed by a reorg. The link to Binance theft proceeds puts THORChain back in the middle of debates about how decentralized protocols should respond when stolen funds pass through them.
Related
