THORChain Halts Trading After Ethereum Glitch, Delaying Binance Hack Fund Transfers

Highlights:

• THORChain halted trading on 10 blockchains after an Ethereum error caused an incorrect 10 ETH refund.
• Chainalysis said the trading halt also delayed attempts to move funds stolen in the recent Binance hack.
• THORChain said the user returned 10 ETH, while developers work to safely reopen affected networks.

Decentralized crypto exchange THORChain halted trading across several blockchain networks on October 31 after an Ethereum error caused an incorrect 10 ETH refund. The shutdown also disrupted attempts to move cryptocurrency stolen in the recent $6.3 billion Binance hack. Blockchain analytics firm Chainalysis said the unexpected trading halt delayed the hackers’ fund transfers.

In a November 1 post on X, THORChain explained that the error forced its system to refund 10 ETH that its vault had never received. The user later returned the funds. However, several blockchains remained suspended while developers investigated the problem.

On October 31, THORChain halted trading on several blockchains.

An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators…

— THORChain (@THORChain) November 1, 2026

Ethereum Glitch Forces THORChain to Halt Trading

According to THORChain, the incident began at 11:34 UTC on October 31, when Ethereum experienced a one-block reorganization. A block reorganization, or reorg, happens when a blockchain replaces a recently recorded block with another version. A user had deposited 10 ETH into a THORChain vault. The protocol initially recognized the transaction and credited the deposit. However, Ethereum later removed the block containing that transaction.

The user’s swap also failed to meet its price limit, prompting THORChain to issue a refund. As a result, the protocol paid out 10 ETH that it had never received. The original deposit was also refunded separately. THORChain’s automatic solvency checker detected the missing funds and immediately stopped Ethereum swaps. Within approximately two minutes, node operators halted outgoing ETH transactions. They later suspended trading on other blockchains as a precaution.

THORChain Trading Halt Delays Binance Hack Fund Transfers

The shutdown also affected hackers who were using THORChain to move cryptocurrency stolen from Binance. According to an October 31 report by Elliptic, approximately $31 million in stolen Binance funds had passed through THORChain. The analytics firm found that attackers were repeatedly using the protocol to exchange cryptocurrency between different blockchains.

However, the Ethereum error interrupted those transfers. In an October 31 post on X, Chainalysis confirmed that the unexpected shutdown had delayed attempts to launder funds stolen from Binance. “THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” the firm wrote.

THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.

The reason? An Ethereum reorg.

One happened this morning and caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH.

This triggered an… pic.twitter.com/B4hvNVPfIW

— Chainalysis (@chainalysis) October 31, 2026

However, THORChain did not freeze or recover a confirmed amount of stolen Binance funds. The shutdown temporarily blocked trading routes, preventing further swaps through the affected networks. Chainalysis did not disclose the value of the stolen cryptocurrency delayed by the suspension. Separately, Elliptic reported that approximately $2.85 billion from the wider Binance hack had been frozen or seized. Those freezes were separate from THORChain’s trading halt.

THORChain Keeps 10 Blockchains Halted While Developers Work on Fixes

In its November 1 update, THORChain said trading remained available on Avalanche, Base, RUNE and XRP Ledger. However, 10 other networks, including Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Dogecoin, Litecoin, Bitcoin Cash, Cosmos and Zcash, remained suspended. THORChain warned that attackers could exploit the same refund error if another blockchain reorganization occurs. Developers are now working on security fixes to prevent similar incidents.

The protocol also explained that three node votes can trigger an emergency halt, while four opposing votes can reverse that decision. Meanwhile, the user involved in the original transaction has returned the extra 10 ETH, restoring the affected vault’s balance.

Node operators will decide when to reopen each suspended blockchain after completing the necessary security checks. THORChain has not announced an exact reopening date.