THORChain Pauses Cross-Chain Swaps After Ethereum Reorg Exposes Refund Flaw

By Coinvote

Published November 2, 2026 - 11:23 UTC | 5 mins read

THORChain node operators suspended swaps on 10 networks after an Ethereum block reorganization exposed a flaw in how the protocol issues refunds. Chainalysis says the pause may also have slowed North Korean efforts to launder funds taken in the $6.3 billion Binance hack.

A one-block reorg sets off an unexpected refund

THORChain halted swaps across several blockchains on Saturday after an Ethereum block reorganization revealed a bug in its refund logic, Cointelegraph reported. According to THORChain, the incident began at 11:34 UTC.

The sequence was narrow but telling. A one-block reorganization on Ethereum erased a 10 ETH deposit that the protocol had already credited. The related swap then failed to meet its price limit, so THORChain issued a refund against funds its vault had never actually received.

The sender's real deposit was refunded as well, which produced an extra 10 ETH payout. That overpayment tripped an automatic pause, and node operators then extended the halt to a much wider set of assets.

Why a reorg can turn into a payout problem

An Ethereum reorg occurs when a newly recorded block is dropped from the chain and another block takes its place. A transaction that sat in the discarded block may simply not exist in the replacement. A protocol that has already acted on that transaction can end up holding a record of a payment the chain no longer recognizes.

That is the mismatch Cointelegraph describes. The flaw allows THORChain to refund a payment that Ethereum no longer treats as having happened. The protocol's team warned that, now the problem is public, an attacker could exploit any reorg on an external chain by submitting a fresh transaction that reuses the same nonce and collecting funds from the vaults.

Nonces matter here because they order an account's transactions. Reusing one after a reorg is exactly the kind of edge case that cross-chain systems must handle when they accept deposits before the underlying chain has fully settled.

The key figures behind the pause

The numbers in the report are few, but they define the scope of the halt and the context around it.

10 ETH: the deposit removed by the reorganization, and also the size of the extra payout.
11:34 UTC on Saturday: when THORChain says the incident began.
10 networks: the chains whose swaps were paused, including Bitcoin, Ethereum, Solana and Tron.
Avalanche, Base and XRP: the networks still trading, as listed on the protocol's network status page.
$6.3 billion: the size of the Binance hack whose laundering Chainalysis says was disrupted.

Chainalysis sees an accidental obstacle for launderers

The pause landed in the middle of the response to last week's Binance theft. Chainalysis said on Sunday that the THORChain stoppage unintentionally held up the movement of a large share of the money taken from Binance. The firm said the emergency pause blocks every user, North Korea-linked launderers among them, from making cross-chain swaps. Cointelegraph's headline frames this as a possible slowdown, and the wording in the body is similarly conditional.

Chainalysis added that, while the service stays offline, most of THORChain's bridges are closed to the hackers and to every other user. North Korean hackers have used the protocol to swap assets without permission after earlier attacks, Cointelegraph noted.

US authorities were already pressing the industry. Cointelegraph reported that the FBI on Saturday urged providers of virtual asset services, including DeFi platforms and THORChain's node operators, to block transactions associated with addresses TraderTraitor used to launder the Binance proceeds. Cointelegraph also linked to separate coverage of a 13% jump in the RUNE token after the hack, but the report does not say the pause moved any price.

The neutrality argument behind the scenes

The technical halt arrives alongside a long-running dispute over whether THORChain should restrict flows of stolen money. The project's third-quarter report said it still describes itself as neutral, permissionless infrastructure, even as it faces calls to stop transactions tied to stolen money.

Founder John-Paul Thorbjornsen defended the same principle separately. He cautioned that a decision by node operators to take the protocol offline would end the experiment, and said no other venue for neutral settlement would be left. The current pause was triggered by a software flaw rather than a policy decision, a distinction that matters for how the episode is read.

What one outlet's account does and does not establish

The reporting here rests on Cointelegraph alone, so there are no competing outlet accounts to compare. The timeline and mechanics come from THORChain's own description, while the laundering impact comes from Chainalysis. Those are two different claims with different levels of certainty.

Cointelegraph does not describe any theft through the refund flaw beyond the extra 10 ETH payout. It also does not say how long the pause will last. The quoted statement from the node operators is that chains will be re-enabled "as they are deemed safe," which sets no timetable.

What to watch next

The first open question is how quickly node operators restore the paused networks, and in what order. The network status page is the place to check which of the 10 chains are live, particularly for anyone with a swap in flight.

A second question is whether THORChain changes how it handles deposits that a reorg can reverse, since the team itself says the flaw is now widely known. A third is whether node operators act on the FBI's request, given the protocol's stated stance on neutrality.

Readers following Ethereum-based projects can also track new Ethereum token listings on Coinvote while the situation develops.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$77,811	-0.1%	-3.2%	$1.56 trillion
Ethereum (ETH)	$2,284	+0.6%	-2.1%	$279.03 billion
XRP (XRP)	$1.25	-0.4%	-3.2%	$79.09 billion
TRON (TRX)	$0.316102	+1.9%	-4.6%	$30.04 billion

CoinGecko data as of 2026-11-02 (UTC); DeFi TVL from DefiLlama: Ethereum $44.41 billion, Solana $5.48 billion, Tron $5.29 billion.

On Coinvote

New Solana Tokens Listed Today: 3,765 projects tracked, 43 new listings in 7 days, 857 community votes today.
Best Solana Meme Coins Today: 2,457 projects tracked, 27 new listings in 7 days, 378 community votes today.
New Ethereum Tokens Listed Today: 2,934 projects tracked, 5 new listings in 7 days, 60 community votes today.
Best Ethereum Meme Coins Today: 260 projects tracked, 2 new listings in 7 days, 29 community votes today.

FAQ

Why did THORChain pause swaps?

An Ethereum block reorganization removed a 10 ETH deposit that THORChain had already credited, and the protocol then refunded funds it never received. The extra 10 ETH payout triggered an automatic pause, according to Cointelegraph.

Which networks are affected by the THORChain halt?

Swaps involving assets on 10 networks were paused, including Bitcoin, Ethereum, Solana and Tron. The protocol's network status page showed trading still running on Avalanche, Base and XRP.

Did the pause affect the Binance hackers?

Chainalysis said the pause may have inadvertently delayed laundering of funds stolen in the $6.3 billion Binance hack. It added that most of THORChain's bridges are closed to the hackers and to all other users until service resumes.