THORChain suspended trading on ten blockchain networks following a brief Ethereum reorganization that produced a solvency imbalance of 10 ETH in one of its vaults. The incident unfolded at 11:34 UTC on October 31 when a single-block reorg discarded a previously observed deposit, yet the protocol had already credited the funds and later issued a refund against assets it never received.

How the Reorganization Created the Mismatch

During the one-block reorganization, a user’s 10 ETH deposit appeared in a block that Ethereum later removed from its canonical chain. THORChain’s observation system recorded the deposit and credited the corresponding vault. When the linked swap failed to meet its price conditions, the protocol processed a refund, paying out 10 ETH that had never settled on the final Ethereum chain.

The resulting discrepancy left the vault short by that amount. All nodes registered the reorganization, but the automated re-check process did not complete in time to prevent finalization of the refund. THORChain’s solvency checker detected the imbalance almost immediately and halted Ethereum swaps. Node operators then voted to pause outgoing Ethereum transactions within roughly two minutes, followed by additional votes that extended the suspension to other connected chains as a precautionary measure.

Current Trading Status and Remediation Efforts

As of the latest updates, trading remains open on AVAX, BASE, RUNE and XRPL. The following networks stay paused pending further security reviews: ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC. Node operators will restore each chain only after confirming that necessary checks and protective measures are in place.

Core developers have identified additional risks associated with external-chain reorganizations. An attacker could potentially exploit duplicated transactions sharing the same nonce to force further incorrect payouts. Work continues on strengthening observation and finalization procedures to reduce exposure to such events. Emergency halts require three node votes and can be reversed through the same consensus process; the votes do not grant those nodes discretionary control over network assets.

Unintended Impact on Binance Theft Laundering Routes

The broad pause coincided with ongoing efforts to track funds stolen in a major Binance breach reported around October 29. That incident involved more than $6 billion in virtual assets and has been attributed by U.S. authorities to North Korea’s TraderTraitor operation. Blockchain intelligence firm Chainalysis observed that the THORChain interruption delayed the movement of a significant portion of those stolen assets through cross-chain swap routes.

The firm separately noted that the pause inadvertently delayed laundering of a substantial volume of the stolen Binance funds. The disruption affected ordinary users and suspected laundering activity alike; it stemmed solely from the accounting shortfall rather than any targeted intervention.

Law Enforcement Outreach to Node Operators

While developers addressed the technical issue, the Federal Bureau of Investigation, working with the U.S. Secret Service and IRS Criminal Investigation, issued an alert on October 31. The agencies urged THORChain node operators, along with other infrastructure providers, to prevent transactions linked to addresses associated with the Binance theft. The request is voluntary and does not constitute a formal order.

THORChain’s architecture lacks a mechanism to block individual swaps, senders or recipients. Operators can only pause entire chains or the broader network, producing network-wide effects rather than selective freezes. Technical co-founder Chad Barraford stated that operators already have access to publicly available information, describing the situation as one that requires no subpoenas and represents a favorable condition for investigative work.

The accounting error and subsequent pause lasted several hours. Restoration has proceeded on a chain-by-chain basis once developers and operators complete their reviews. The episode illustrates the interaction between external-chain finality assumptions and cross-chain protocol safeguards, as well as the practical limits of selective transaction control on a permissionless network.