Ethereum Reorganization Triggers THORChain Pause, Delaying Laundering Route
TokenPost (October 31, 2026)
Sections:
- Sign in
- News
- Markets
- Feed
- Data
- Research
A duplicate refund tied to a 10 ETH deposit triggered the halt. Chainalysis linked the interrupted route to Binance funds stolen by North Korean hackers.
By Simon Yoon
Save Share
Mentioned assets:
- ETH - Ethereum
THORChain halted swaps across most of its cross-chain bridges after an Ethereum reorganization caused it to refund a user's 10 Ether (ETH) deposit twice. The emergency pause temporarily prevented all users from exchanging assets through most of those bridges, extending the disruption beyond the account that received the duplicate payment.
Chainalysis linked the affected route to North Korean hackers laundering a large amount of funds stolen from Binance. It said the pause delayed that activity by interrupting access to THORChain's cross-chain swaps. The service suspension thus had two effects: it followed a refund error tied to one 10 ETH deposit and disrupted a route associated with the movement of stolen funds.
The incident began with a change to Ethereum's chain history, then led to a separate protocol-level response at THORChain. Most of the protocol's bridge-based exchange activity was unavailable to users for a period, and that same interruption unexpectedly slowed the laundering process identified by Chainalysis.
Simon Yoon
Reporter
*Simon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to [EMAIL_REDACTED].
Ethereum, Binance, Chainalysis, THORChain, North Korean hackers, Join the discussion
Back to top Follow on X
Newsroom
... (rest of the original content preserved as requested)