THORChain triggered its emergency pause after an Ethereum reorganization led it to refund the same deposit twice. Chainalysis says the halt was connected to funds stolen from Binance. The pause came from the reorg and the double refund, not from any move against those funds.
THORChain hit its emergency brake after an Ethereum reorganization caused the protocol to refund the same deposit twice. The halt also slowed efforts to launder stolen funds, according to Chainalysis.
A reorg triggers a duplicate refund
On October 31, 2026, Ethereum went through an unexpected reorganization, usually called a reorg. THORChain then mistakenly issued a duplicate refund on a deposit of 10 ETH.
In a reorg, the network swaps out recently confirmed blocks for a competing chain of blocks. Transactions that looked final can shift, disappear, or show up again in a new position. A cross-chain protocol that watches Ethereum and responds to deposits can therefore act on the same event twice.
The duplicate refund activated the emergency pause, and trading and swaps stopped across 12 of the 13 chains the protocol supports. The shutdown was not total, however, because outbound signing stayed active on most of the affected chains.
How the pause works
THORChain is run by node operators, and its rules let them put network integrity ahead of uptime while a problem is investigated. A halt like this can last up to 720 blocks, or about 1.5 hours, and more votes from nodes can extend it.
Chainalysis links the halt to the Binance theft
The pause also affected other activity. Chainalysis, the blockchain analytics firm, linked the emergency halt to funds stolen from Binance and tied the laundering activity to DPRK actors, meaning groups associated with North Korea.
With swaps frozen on 12 chains, anyone trying to push those funds through THORChain had to wait. Moving assets quickly between chains is a common way to make stolen money harder to trace, so even a brief delay gives investigators more time.
This was not the protocol's first halt of 2026. Earlier this year, it dealt with exploits and with halts linked to ZEC and TRON.
Watchers now want to know whether node operators vote to extend the halt past the 720-block window and how the protocol handles the extra 10 ETH refund.
Source: Crypto Briefing
Trading involves risk.
Risk Disclaimer
