An Ethereum block reorganization on Saturday caused THORChain to pay out the same 10 ETH refund twice, setting off an emergency pause that has also cut off one of the routes used to launder funds stolen from Binance, according to Chainalysis. The cross-chain swap network’s trading halts were still in place hours later, leaving the North Korea-linked attackers, and every other user, unable to swap through most of its bridges.
The pause was not aimed at the hackers. It was a safety brake pulled after a refund error, and the delay it causes for the launderers is a side effect.
What Chainalysis reported
“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis said on Saturday. The firm said a reorg “this morning” caused THORChain “to incorrectly issue a double refund to someone who had deposited 10 ETH,” which triggered an emergency pause.
“Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges,” the firm added.
A reorg happens when a blockchain swaps out recent blocks for a competing set. Transactions that looked confirmed can disappear or land in a different position. A cross-chain protocol that acts on a deposit before it is final can end up acting on the same event twice, which is what Chainalysis describes here.
Trading halted on all 13 chains at last check
The Defiant reported that swaps remained paused on 12 chains, with outbound signing enabled on most of them so that payments could still go out while new swaps stayed blocked.
When AltcoinReporter queried a public THORChain node on Saturday evening, the network’s configuration showed trading halt flags set on all 13 connected chains: Avalanche, Base, Bitcoin Cash, BNB Chain, Bitcoin, Dogecoin, Ethereum, Cosmos Hub, Litecoin, Solana, Tron, XRP Ledger and Zcash. Outbound signing was halted only on Solana and Cosmos Hub. A second check a few minutes later showed no change.
Under THORChain’s emergency procedures, a single node operator can trigger a network-wide pause lasting 720 blocks, or about 1.5 hours, and other nodes can extend it. Our check showed that network-wide timer had already lapsed. The chain-specific trading halts, which nodes set through votes, were what kept swaps closed.
THORChain’s main X account had not posted about the halt as of our check, and the project has not publicly confirmed the cause Chainalysis described.
Why THORChain matters to the Binance launderers
THORChain lets users swap native assets across chains, such as ETH for bitcoin, without a company in the middle that can freeze individual transfers. That has made it a favoured tool for North Korean hackers. Analytics firms reported that the Lazarus Group pushed much of the ETH stolen from Bybit in February 2025 through THORChain into bitcoin. AltcoinReporter also covered THORChain’s own trading halt after a $10.8 million Asgard vault exploit in May.
Chainalysis puts the Binance theft at about $6.4 billion and attributes it to North Korea’s TraderTraitor group. Earlier on Saturday, the firm described another tactic the attackers have used on Tron since the first hours of the theft. They swap TRX into stablecoins, deposit those stablecoins into a DeFi lending protocol in exchange for receipt tokens that issuers cannot freeze, move the receipts to clean wallets, redeem them, and bridge out of Tron into ETH. The Defiant reported that on-chain records point to Tron’s JustLend as the lending protocol involved.
“Now the exploiter is free of worry of a freeze,” Chainalysis wrote of that last step. It said Circle and Tether have contributed to $2.8 billion in freezes so far. Stablecoin freezes on Tron have been a recurring tool for investigators, as in Tether’s $39.3 million freeze across 10 Tron wallets in September.
Chainalysis’ two posts fit together. The Tron route ends in ETH, and THORChain is one of the main ways to swap ETH into native assets on other chains, such as bitcoin. With THORChain halted, that swap has to wait or use a different route.
What to watch next
The pause buys investigators and exchanges time to flag addresses, but only while it lasts. Node operators will decide when to lift the trading halts and whether to change how THORChain handles Ethereum deposits before they are final. How the duplicate 10 ETH refund is dealt with is also unresolved.
Chainalysis is dealing with its own security problem at the same time. On Friday it disclosed that an attacker using “offensive agentic techniques” accessed some customer names, emails and role labels, and said that incident is not related to the Binance theft.
FAQ
Why did THORChain pause? According to Chainalysis, an Ethereum reorg caused THORChain to refund a 10 ETH deposit twice, which triggered an emergency pause.
Did THORChain freeze the Binance hackers’ funds? No. The halt stops all swaps for everyone. It delays laundering through THORChain but does not seize or freeze any funds.
Should users send funds to THORChain during the halt? No. At our Saturday evening check, THORChain’s inbound address list marked all 13 chains as halted, which signals wallets and front ends not to send deposits. Outbound signing stayed enabled on every chain except Solana and Cosmos Hub.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
