On October 31, 2026, THORChain paused trading and swaps across 12 of its 13 supported blockchains after an unexpected Ethereum chain reorganization caused the protocol to issue a duplicate 10 ETH refund. Node operators triggered the emergency brake, keeping outbound signing active while swaps froze. According to Chainalysis, the unintended shutdown temporarily disrupted North Korea-linked actors attempting to launder funds stolen from Binance.
Ethereum reorg causes duplicate refund
- ▪An unexpected reorganization of the Ethereum network on October 31, 2026 caused THORChain to issue a duplicate refund on a single deposit of 10 ETH
- ▪THORChain's emergency pause mechanism was activated after an Ethereum reorg caused a duplicate 10 ETH refund to be processed, catching the anomaly post-transaction rather than preventing it beforehand
- ▪THORChain paused trading and swaps across 12 of the 13 chains it supports after an Ethereum reorganization triggered a double refund error on October 31, 2026
Operational state during the pause
- ▪THORChain's node-operated emergency halt rules automatically pause network activity for up to 720 blocks, or approximately 1.5 hours, unless extended by node votes
- ▪THORChain kept outbound signing active on most affected chains during the October 31, 2026 swap pause, allowing existing payments to proceed while new swaps remained blocked
Impact on North Korean money laundering
- ▪Chainalysis linked the illicit money laundering activity traversing THORChain during the October 31, 2026 halt to cyber actors associated with North Korea (DPRK)
- ▪Blockchain analytics firm Chainalysis reported that THORChain's emergency halt temporarily slowed DPRK-linked efforts to launder funds stolen from Binance by freezing cross-chain swaps
Story comments
Loading comments…