The short version
- THORChain halted trading on 10 chains, including Bitcoin and Ethereum, after a one-block Ethereum reorg made it pay out 10 ETH that its vault never received.
- The pause also stalls North Korea’s Binance hackers: the FBI has asked THORChain node operators to block their addresses, and RUNE is down 22% since Saturday.
- Next: whether the nodes block the FBI’s address list when the chains reopen. We’ll post it on Base Camp on X as soon as THORChain trades again.
THORChain halted trading on 10 of the 13 outside blockchains it connects on Saturday, and at the time of writing they are still closed. The trigger was tiny: a one-block Ethereum reorg made the cross-chain swap network pay out 10 ETH, about $22,900, that its vault never received.
The timing is what makes it big. Hours later, the FBI asked THORChain node operators by name to block the North Korean hackers behind the $6.3 billion Binance hack, who have been using cross-chain swaps to move the stolen coins.
THORChain posted its full breakdown on Sunday night:
On October 31, THORChain halted trading on several blockchains.
An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators
How an Ethereum Reorg Made THORChain Pay Twice
At 11:34 UTC on October 31, Ethereum dropped one block and replaced it. A 10 ETH deposit to a THORChain vault sat in the dropped block and never made it onto the final chain.
THORChain’s nodes had already seen and credited it. The swap then missed its price limit, so THORChain refunded 10 ETH it never had, and the sender’s real deposit was refunded as well. Every node noticed the reorg, THORChain said, but the re-check that should have cancelled the deposit “could not get a clear answer in time.”
The safety net worked. THORChain’s solvency checker spotted the shortfall and stopped ETH swaps automatically, and within about two minutes three node votes stopped all ETH payments out of the vaults. The user has since sent the 10 ETH back.
With THORChain halted on Ethereum, the nodes then stopped every other big chain as well. The reason is the uncomfortable part: now that the flaw is public, anyone could wait for a reorg on any connected chain, resend a deposit with the same nonce and get paid twice by the vaults.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Which Chains Has THORChain Halted?
Ten of them: Bitcoin, Ethereum, Solana, BNB Chain, TRON, Zcash, Litecoin, Dogecoin, Bitcoin Cash and Cosmos. Only Avalanche, Base, the XRP Ledger and THORChain’s own RUNE still trade, according to THORChain’s live node data at the time of writing.
The network has gone almost silent. THORChain’s data service Midgard counted about 8,800 swaps on Sunday, against roughly 1.08 million on each of Thursday and Friday and about 190,000 a day the week before.
There is no reopening date. Core developers are working on a fix, and nodes “will decide to re-enable chains as they are deemed safe.” Funds in the vaults aren’t at risk from the halt itself: three node votes can pause a chain, four can reverse it, and THORChain says halting gives no one control of the assets.
Why the THORChain Halt Matters for the Binance Hack
Blockchain analytics firm Chainalysis said on Saturday that THORChain “just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.” The pause hits everyone, North Korea’s launderers included.
That evening the FBI formally blamed North Korea for the Binance theft, naming the group TraderTraitor. It said the hackers are converting stolen coins mostly into ETH and expects them to launder further “using DeFi and instant swap services.” It urged “THORNode operators,” first on its list, to block transactions with or derived from the addresses it published.
THORChain has been here before. After the $1.5 billion Bybit hack in February 2025, the same group swapped more than $1 billion of stolen ETH into Bitcoin through THORChain, and the nodes didn’t stop it. THORChain’s Sunday update doesn’t mention the FBI request, so whether nodes block those addresses once chains reopen is the open question.
The launderers aren’t stuck, though. On Sunday Chainalysis said funds have left TRON through routes including Chainflip, Relay, THORChain and NEAR, and that a new phase has moved onto Solana.
SIDE TRAIL: Can Crypto Be Frozen? Who Froze $2.7B of the Binance Hack, and Why $2.4B Got Away
RUNE Price After THORChain Halted Trading
The RUNE price is taking the hit, since RUNE is the token every THORChain pool pairs with. It opened Saturday at $0.650 and trades at $0.507 at the time of writing, down 22% since the halt and 21% in 24 hours, its lowest level since mid-September. That wipes out the whole late-September run to $0.837.
RUNE is now sitting on its 200-day MA at $0.498. Below it, $0.479 is the September support; above, the old October floor at $0.612 is resistance.
TRAIL MAP: DeFi Basics: Swaps, Liquidity Pools and Impermanent Loss
Satoshi Flipper has more than 20 years of trading experience, starting in stocks before moving into crypto in 2017, and holds an MBA from the Kellogg School of Management. The edge is reading the economic data: rate decisions, inflation, jobs numbers, earnings and the US markets that move Bitcoin.
More from Satoshi Flipper
