Cross-chain network paths interrupted by a displaced block

THORChain Reorg Bug Halts Swaps—and Interrupts the Binance Hackers’ Exit Route

By Isaac • November 1, 2026 11:52 pm • Comments

A one-block Ethereum reorganization exposed a refund bug inside THORChain, forced node operators to halt swaps across most supported networks and—at least temporarily—closed one route being used to move funds stolen from Binance.

Cointelegraph reports that the incident began at 11:34 UTC Saturday. THORChain credited a 10 ETH deposit, but an Ethereum reorganization later removed the block containing that deposit.

When the swap missed its price limit, the protocol issued a refund from a vault that had never actually received those funds. The sender’s original deposit was also refunded, producing an extra 10 ETH payout.

Trending: Ripple Unlocks 1 Billion XRP as Binance Reopens a Major Liquidity Route

THORChain’s automatic solvency checker detected the shortfall and halted Ethereum swaps. Node operators then paused assets across 10 networks while they assessed whether the same mismatch could be exploited elsewhere.

The pause covered major routes including Bitcoin, Ethereum, Solana and Tron, while Avalanche, Base and XRP remained available. That made the response both a technical containment step and a sudden reduction in cross-chain liquidity.

How one missing block created two refunds

A blockchain reorganization occurs when the network replaces a recent block with a competing version of the chain. Most applications are built to tolerate that possibility.

In this case, however, THORChain had already acted on a deposit that Ethereum later treated as if it had never happened.

That timing gap created the accounting problem. THORChain’s vault paid a refund against a deposit it no longer possessed, while Ethereum’s own state returned the original funds.

Once the mechanism was public, the risk was larger than the 10 ETH loss: a malicious actor could wait for another reorganization and attempt to reproduce the mismatch.

Swaps involving Bitcoin, Ethereum, Solana, Tron and other networks were paused. Trading reportedly continued on Avalanche, Base and XRP.

THORChain said nodes would re-enable chains as each one was judged safe.

The halt also hit the Binance hackers

The emergency action had an unintended law-enforcement consequence. Chainalysis said the pause delayed attempts by North Korean hackers to launder part of the roughly $6.3 billion stolen from Binance.

With most of THORChain’s cross-chain routes unavailable, the attackers lost access to a major permissionless swap path at the same time legitimate users did.

The FBI’s alert on the Binance attack attributed the theft to North Korea’s TraderTraitor operation and urged virtual-asset businesses, decentralized-finance providers and other crypto infrastructure operators to block transactions tied to identified addresses before the stolen assets could be dispersed further through bridges, exchanges and permissionless swap services.

The request put infrastructure operators and centralized exchanges on notice that cross-chain services could become part of the laundering route during the first hours after a major theft. It also gave compliant providers a concrete basis for screening the identified flows while investigators followed the funds across several networks.

Binance, meanwhile, continued reopening withdrawals across major networks. Its latest update listed BTC, ETH, BNB, XRP, DOGE and several stablecoin routes among the assets already restored.

The episode captures THORChain’s central tension. Its supporters see neutral, permissionless settlement as the point of the protocol.

Governments and investigators see infrastructure that can also help thieves move between chains. Here, the protocol did not stop because an authority ordered it to censor an address.

It stopped because a technical bug threatened the solvency of its own vaults.

That distinction matters. The pause slowed stolen funds, but it also demonstrated that cross-chain systems inherit failure modes from every network and accounting assumption they connect.

A single displaced Ethereum block was enough to turn a routine refund into a system-wide emergency.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews