A duplicate 10 ETH refund tripped the protocol's emergency brake, and Chainalysis tied the halt to funds stolen from Binance
THORChain hit the emergency brake after an Ethereum reorganization caused the protocol to refund the same deposit twice.
The pause had a side effect that matters beyond one refund. According to Chainalysis, the halt was connected to funds stolen from Binance, and it slowed efforts to launder them.
What happened on the chain
On October 31, 2026, Ethereum went through an unexpected reorganization, usually called a reorg. THORChain then mistakenly issued a duplicate refund on a deposit of 10 ETH.
To picture a reorg, imagine a shared notebook where several people write down transactions. Two people briefly record different versions of the last page, and the group eventually tears one out and keeps the other.
In technical terms, the network swaps out recently confirmed blocks for a competing chain of blocks. Transactions that looked final can shift, disappear, or show up again in a new position.
For a cross-chain protocol that watches Ethereum and responds to deposits, that is a problem. If the history it saw gets rewritten, it can act on the same event twice. Here, that meant paying back one 10 ETH deposit two times.
The duplicate refund activated THORChain’s emergency pause. Trading and swaps stopped across 12 of the 13 chains the protocol supports.
The shutdown was not total. Outbound signing stayed active on most of the affected chains, so some transactions could still go out while swaps were frozen.
How the emergency pause works
THORChain is run by node operators, and its rules let them put network integrity ahead of uptime while a problem is investigated.
A halt like this can last up to 720 blocks, or about 1.5 hours. More votes from nodes can extend it.
The Binance connection
The odd part of the story is who else was affected.
Chainalysis, the blockchain analytics firm, linked the emergency halt to funds stolen from Binance. The firm tied the laundering activity to DPRK actors, meaning groups associated with North Korea.
With swaps frozen on 12 chains, anyone trying to push those funds through THORChain had to wait. Moving assets quickly between chains is a common way to make stolen money harder to trace, so even a brief delay gives investigators more time.
The pause was triggered by an Ethereum reorg and a double refund, not by a deliberate move against the stolen funds. Chainalysis’s finding means the delay happened to land on activity tied to the Binance theft.
Not THORChain’s first halt
This was not the protocol’s first operational halt in 2026. Earlier this year it dealt with exploits and with halts linked to ZEC and TRON.
The protocol depends on its native RUNE token to operate as a decentralized liquidity network. Its main pitch is native cross-chain swaps without relying on a centralized exchange in the middle.
That pitch has a cost. Every new chain THORChain adds is one more place where something can go wrong, and an event on one chain, such as an Ethereum reorg, can force a pause across nearly the whole network.
What this means for users and the protocol
For people who use THORChain, the incident shows both the safety net and its limits. The emergency pause did what it was built to do: it caught an anomaly and stopped activity before more damage could build up.
But the double refund still went out. The protocol caught the mistake after making it, not before.
That points to the bigger question for cross-chain liquidity protocols. Their reliability is capped by how well they handle bad data from the chains they connect, including temporary data that is later reversed by a reorg.
The illicit-finance angle complicates things further. Chainalysis’s link to Binance theft proceeds and DPRK-associated actors puts THORChain back in the middle of a debate it keeps running into: how a decentralized protocol should respond when stolen funds pass through it.
Some things to watch from here: whether node operators vote to extend the halt past the 720-block window, how the protocol handles the extra 10 ETH refund, and whether THORChain changes how it deals with Ethereum reorgs.
