Quick answer: On Oct. 31, 2026, an Ethereum reorg made THORChain refund one 10 ETH deposit twice, which tripped an emergency pause of swaps on 12 of its 13 chains. Chainalysis said the THORChain pause also slowed North Korean hackers laundering funds stolen from Binance on Oct. 29.
A routine glitch on Ethereum just did what investigators could not: it slowed the hackers behind the biggest theft in crypto history. The THORChain pause that followed a double refund on Oct. 31 cut off a key cross-chain route for funds stolen from Binance, at least for now.
What triggered the THORChain pause?
On the morning of Oct. 31, 2026 (U.S. Eastern time), Ethereum went through a chain reorganization, or reorg. In a reorg, the network swaps out a few recent blocks for a competing set. Transactions that looked final can move or show up again.
THORChain watches Ethereum for deposits and acts on them. When the recent history changed, it treated one 10 ETH deposit as two events and refunded it twice, Crypto Briefing reported. That duplicate payment set off the protocol’s emergency brake.
Swaps then stopped on 12 of the 13 chains THORChain supports. Outbound signing stayed on for most of them, so some pending payments could still go out, according to TokenPost and THORChain’s status page as cited by The Defiant. Node operators can hold a halt like this for up to 720 blocks, about 1.5 hours, and extend it by vote.
How does this affect the Binance hack funds?
The side effect is the bigger story. Blockchain analytics firm Chainalysis said the route that was cut off was being used to launder funds stolen from Binance, TokenPost reported. With swaps frozen, every user had to wait, including the launderers.
Chainalysis traces the Oct. 29 theft of about $6.4 billion to TraderTraitor, a North Korean hacking group. In its latest findings, the firm said funds began leaving Binance hot wallets at about 20:20 UTC on Oct. 29. It said about $2.8 billion had been frozen and that laundering showed signs of automation, with thousands of fast transactions.
Binance puts the loss at about $6.3 billion and says it will cover users in full. We covered the North Korea link and how EIP-7702 sped up the drain earlier.
Speed matters here. Moving stolen coins quickly between chains makes them harder to trace and freeze. Even a short delay gives exchanges, stablecoin issuers and police more time to act.
Is THORChain safe to use right now?
The halt was not a hack of THORChain, and it was not a move aimed at the stolen funds. It was an automatic safety response to a refund error. Still, the protocol paid the double refund before it caught the problem, which raises questions about how it handles reorgs.
THORChain has faced this debate before. Because anyone can swap through it without an account, it has drawn criticism when stolen funds pass through. Expect that pressure to grow while the Binance money keeps moving.
What does it mean for RUNE and the market?
So far, RUNE has shrugged it off. CoinGecko data show the token fell to about $0.59 at 21:00 UTC on Oct. 29, just after the Binance hack began. It then rose to about $0.72 by 16:00 UTC on Oct. 31. At 19:57 UTC it traded near $0.67, up 5.5% in 24 hours.
Ether held near $2,251 and Bitcoin near $77,493 at the same time, per CoinGecko. For live prices, see our Ethereum price page.
What to watch next
- The restart. Watch THORChain’s status page for when swaps reopen, chain by chain.
- The 10 ETH. Whether the extra refund is recovered, and any fix for reorg handling.
- Laundering routes. Chainalysis expects the stolen funds to keep moving in the coming days, so watch for a shift to other bridges.
- Binance withdrawals. Binance aims to reopen them on Nov. 1, as covered in our withdrawals update.
THORChain pause FAQ
Why did THORChain pause trading?
An Ethereum reorg on Oct. 31, 2026, caused THORChain to refund one 10 ETH deposit twice. The error tripped an emergency pause that stopped swaps on 12 of its 13 chains.
Did the THORChain pause stop the Binance hackers?
It slowed them. Chainalysis said the halt delayed laundering of funds stolen from Binance through THORChain. It did not freeze or recover the stolen coins.
Is THORChain hacked?
No. Reports describe a refund error caused by an Ethereum reorg, not an exploit. One 10 ETH deposit was refunded twice before the pause began.
How long can a THORChain pause last?
An emergency halt can run up to 720 blocks, about 1.5 hours. Node operators can vote to extend it while they investigate.
Sources
- Crypto Briefing: THORChain pauses operations after Ethereum reorg triggers double refund
- TokenPost: Ethereum reorganization triggers THORChain pause
- TokenPost: THORChain keeps swaps paused on 12 chains
- Chainalysis: Binance hack latest findings
- PANews: Ethereum reorg led to THORChain pause
- CoinGecko: THORChain (RUNE) price data
This article is for information only and is not financial advice. Crypto assets are volatile; do your own research before making any decision.
