Litecoin

Symbiosis

THORChain

Ethereum

Chainflip

THORChain suspended trading across 10 blockchain networks after an Ethereum transaction processing error triggered an unauthorized 10 ETH refund, temporarily disrupting cross-chain swaps used by North Korean hackers laundering proceeds from Binance’s $6.3 billion security breach.
The October 31 incident prompted an automatic solvency alert and emergency intervention by node operators, who suspended withdrawals and trading while developers investigated the vulnerability. The affected user subsequently returned the 10 ETH, restoring the vault’s balance.
The disruption also interrupted the movement of stolen Binance assets through THORChain, which had already processed approximately $44 million in transactions linked to the attack.
Trading remained suspended on Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash as of November 1, while Avalanche, Base, THORChain’s native RUNE network and XRP Ledger remained operational.
<h2 id="ethereum-reorganization-triggers-thorchain-emergency-halt">Ethereum Reorganization Triggers THORChain Emergency Halt</h2>
The incident began at 11:34 UTC on October 31, when Ethereum experienced a one-block reorganization that removed a 10 ETH deposit previously detected by THORChain.
The protocol had already credited the deposit before the transaction disappeared from Ethereum’s canonical blockchain. When the associated swap failed to meet its price conditions, <a href="https://cryptoadventure.com/thorchain-dex-review-2026-native-cross-chain-swaps-rune-security-and-slip-based-fees/" rel="noopener noreferrer nofollow">THORChain</a> issued a refund against funds its vault had never actually received.
The sender’s legitimate deposit was also refunded, leaving the protocol with a temporary 10 ETH shortfall.
THORChain’s automated solvency checker detected the discrepancy and halted Ethereum swaps. Node operators suspended ETH transaction signing approximately two minutes later before extending restrictions to other networks.
Although the <a href="https://x.com/THORChain/status/2117011632757092501" rel="noopener noreferrer nofollow">missing 10 ETH was subsequently returned</a>, developers identified a potential vulnerability involving how the protocol handles reorganized transactions. An attacker could potentially exploit the same behavior during future block reorganizations to trigger unauthorized payouts.
Core developers are preparing fixes, with node operators responsible for determining when individual networks can safely resume trading.
<h2 id="binance-hackers-move-242-million-through-tron">Binance Hackers Move $242 Million Through Tron</h2>
The trading halt coincided with attempts to launder funds from the <a href="https://cryptoadventure.com/binance-hack-6-3b-affected-3b-in-assets-frozen/" rel="noopener noreferrer nofollow">record $6.3 billion Binance security breach</a>, which U.S. authorities have attributed to North Korea’s TraderTraitor operation.
Blockchain investigator <a href="https://x.com/somaxbt/status/2116884703655723207" rel="noopener noreferrer nofollow">SomaXBT traced approximately $242 million</a> in stolen assets moving through Tron over two days, including roughly $194 million routed through cross-chain bridges and swap services.
Relay handled approximately $48 million, followed by THORChain with $44 million, Chainflip with $32.1 million and Symbiosis with $16 million.
The attackers reportedly deposited 185.1 million TRX and 3.83 million USDT into THORChain through 2,697 transactions, receiving ETH and BTC across numerous destination addresses.
The unexpected shutdown temporarily blocked additional swaps through the affected networks, interrupting part of the laundering operation. The transactions already completed were not reversed.
The FBI has <a href="https://cryptoadventure.com/fbi-links-6-3b-binance-hack-to-north-koreas-tradertraitor/" rel="noopener noreferrer nofollow">formally identified TraderTraitor as responsible for the Binance theft</a>, urging THORChain node operators, exchanges and decentralized finance services to block addresses associated with the stolen funds.
THORChain technical co-founder Chad Barraford maintained that node operators possess no information beyond publicly available blockchain data, but did not commit to blocking the identified addresses.
The controversy echoes the <a href="https://cryptoadventure.com/inside-north-koreas-favorite-crypto-laundering-tool-thorchain/" rel="noopener noreferrer nofollow">laundering of funds stolen during the $1.5 billion Bybit hack</a>, when THORChain became a major route for converting stolen Ethereum into Bitcoin.
Unlike centralized exchanges, THORChain does not currently provide a mechanism for selectively blocking individual transactions. Its emergency controls apply to entire networks, affecting legitimate users and suspected criminals alike.
With the 10 ETH shortfall resolved, the immediate financial discrepancy has been addressed. However, most affected networks remain suspended pending technical fixes, leaving THORChain facing renewed scrutiny over both cross-chain security and the movement of illicit cryptocurrency.
The post <a href="https://cryptoadventure.com/thorchain-halts-10-chains-slows-binance-hack-laundering/" rel="noopener noreferrer nofollow">THORChain Halts 10 Chains, Slows Binance Hack Laundering</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

THORChain Halts 10 Chains, Slows Binance Hack Laundering

Table of Contents

Crypto Adventure

Other articles published on Nov 2, 2026

Join our free newsletter for daily crypto updates!