THORChain reorg halt freezes swaps and slows Binance launderers
A one-block Ethereum reorganization led THORChain to refund a 10 ETH deposit twice on Saturday, tripping an automatic pause that, according to Chainalysis, also stalled attempts to launder funds stolen from Binance.
A small accounting bug just did what regulators have been asking the protocol to do for a week. The THORChain reorg halt that began on Saturday froze cross-chain swaps across most supported networks, and blockchain analysts say it also left North Korean launderers of the Binance haul stuck in the queue.
What happened
According to THORChain's own account, cited by Cointelegraph, the problem started at 11:34 UTC on October 31. A one-block reorganization on Ethereum erased a 10 ETH deposit the protocol had already credited. When the related swap failed its price limit, THORChain refunded money its vault never received, and the sender's real deposit was refunded too. That extra 10 ETH payout triggered the automatic solvency pause.
Counts of the affected networks differ. Cointelegraph counted 10 networks where node operators stopped swaps, among them Bitcoin, Ethereum, Solana and Tron, with Avalanche, Base and XRP still trading. Crypto Briefing reported trading stopped on 12 of the 13 chains the protocol supports, with outbound signing still active on most of them.
The fix came quickly on the money side. ChainCatcher reported that the user returned the 10 ETH, restoring the vault's solvency, though some chains stayed suspended while patches were prepared. KuCoin's daily report described the same sequence.
Why it matters
The bug itself is the bigger worry. THORChain warned that, now the flaw is public, an attacker could reuse a transaction nonce whenever an external chain reorganizes and be paid out of its vaults, Cointelegraph reported. That is why nodes are bringing chains back only as each one is deemed safe.
Then there is the side effect. Chainalysis said on Sunday that the pause "inadvertently delayed the laundering of a significant amount of funds stolen from Binance", because nobody, including the DPRK's money launderers, could swap through most of the bridges. The FBI had urged THORChain node operators and DeFi services on Saturday to block addresses tied to TraderTraitor, the group our TraderTraitor attribution story covered.
THORChain has long said it is neutral, permissionless infrastructure. Founder John-Paul Thorbjornsen repeated that view, warning that if nodes took the protocol offline in response to pressure "the experiment is over". Other DeFi venues chose differently last week; our report on the Aave market freeze showed how lending markets locked out the exploiter.
The episode exposes a structural limit. Cross-chain protocols are only as reliable as their handling of data that a source chain later rewrites, and a single event on Ethereum forced a pause across almost the whole network.
Until the THORChain reorg halt is lifted on every affected chain, swaps that would route stolen funds through the protocol cannot complete, which is why analysts see the pause as a brake on laundering.
What's next
Watch how long the remaining chains stay offline and whether THORChain changes how many confirmations it waits for before crediting Ethereum deposits. Cointelegraph's account of the incident includes the team's statement.
The THORChain reorg halt also hands critics a test case: when swaps restart, any renewed flow of Binance-linked funds through the protocol will be watched closely by investigators and node operators alike.
RUNE holders have felt the strain; Crypto Briefing's market panel showed the token among the weekend's biggest decliners.
This article is for information only and is not investment advice.