THORChain suspended trading across 10 blockchain networks after an Ethereum transaction processing error triggered an unauthorized refund of 10 ETH, temporarily disrupting the cross-chain swaps used by North Korean hackers to launder proceeds from Binance's $6.3 billion security breach.

THORChain is a decentralized liquidity protocol that lets users swap assets across different blockchains without a centralized intermediary — a design that has repeatedly placed it in the path of funds stolen from major crypto venues.

The October 31 incident activated an automatic solvency alert and prompted emergency intervention by node operators, who suspended withdrawals and trading while developers investigated the vulnerability. The affected user subsequently returned the 10 ETH, restoring the vault's balance.

The disruption also interrupted the flow of stolen Binance assets through THORChain, which had already processed roughly $44 million in transactions linked to the attack. As of November 1, trading remained suspended on Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash, while Avalanche, Base, THORChain's native RUNE network and the XRP Ledger stayed operational.

Ethereum Reorganization Triggers Emergency Halt

The incident began at 11:34 UTC on October 31, when Ethereum experienced a one-block reorganization that removed a 10 ETH deposit THORChain had previously detected. Reorganizations occur when the network replaces a recently added block with a competing version, meaning transactions that appeared confirmed can briefly vanish from the canonical chain. The protocol had already credited the deposit before the transaction disappeared from Ethereum's canonical chain. When the associated swap failed to meet its price conditions, THORChain issued a refund against funds its vault had never actually received. The sender's legitimate deposit was refunded as well, leaving the protocol with a temporary 10 ETH shortfall.

THORChain's automated solvency checker detected the discrepancy and halted Ethereum swaps. Node operators suspended ETH transaction signing roughly two minutes later, then extended restrictions to other networks.

Although the missing 10 ETH was subsequently returned, developers identified a potential vulnerability in how the protocol handles reorganized transactions. An attacker could exploit the same behavior during future block reorganizations to trigger unauthorized payouts. Core developers are preparing fixes, and node operators are responsible for determining when individual networks can safely resume trading.

Binance Hackers Move $242 Million Through Tron

The halt coincided with attempts to launder funds from the record $6.3 billion Binance security breach, which U.S. authorities have attributed to North Korea's TraderTraitor operation, the label U.S. agencies use for North Korean campaigns targeting cryptocurrency platforms.

Blockchain investigator SomaXBT traced approximately $242 million in stolen assets moving through Tron over two days, including roughly $194 million routed through cross-chain bridges and swap services. Such services draw investigative attention because each hop changes both the chain and the token carrying the stolen funds. Relay handled approximately $48 million, followed by THORChain with $44 million, Chainflip with $32.1 million and Symbiosis with $16 million.

The attackers reportedly deposited 185.1 million TRX and 3.83 million USDT into THORChain through 2,697 transactions, receiving ETH and BTC across numerous destination addresses. The unexpected shutdown temporarily blocked additional swaps through the affected networks, interrupting part of the laundering operation, though transactions already completed were not reversed.

The FBI has formally identified TraderTraitor as responsible for the Binance theft, urging THORChain node operators, exchanges and decentralized finance services to block addresses associated with the stolen funds. THORChain technical co-founder Chad Barraford maintained that node operators possess no information beyond publicly available blockchain data, but did not commit to blocking the identified addresses.

The controversy echoes the laundering of funds stolen in the $1.5 billion Bybit hack, when THORChain became a major route for converting stolen Ethereum into Bitcoin. Unlike centralized exchanges, THORChain does not currently offer a mechanism for selectively blocking individual transactions; its emergency controls apply to entire networks, affecting legitimate users and suspected criminals alike.

With the 10 ETH shortfall resolved, the immediate financial discrepancy has been addressed. Most affected networks, however, remain suspended pending technical fixes, leaving THORChain under renewed scrutiny over both cross-chain security and the movement of illicit cryptocurrency.