UPDATE: THORChain outage tied to double-refund glitch amid Binance hacker hunt
CIE News ·
Update to THORChain pauses swaps across 10 networks following block reorg bug
Based on reporting by CryptoSlate; not yet independently confirmed.
THORChain halted swaps across 10 networks after an Ethereum reorg caused a double-refund bug, which CryptoSlate reports disrupted laundering routes tied to the $6 billion Binance hack.
A double-refund anomaly triggered by an Ethereum blockchain reorganization prompted THORChain's recent swap pause across 10 networks, as reported by CryptoSlate and Cointelegraph. As previously reported, node operators suspended swaps across networks including Bitcoin (BTC), Ethereum (ETH), Solana (SOL), and Tron (TRX) following a reorganization issue. CryptoSlate reported that the technical error inadvertently disrupted laundering routes used by hackers behind Binance's $6 billion exploit.
On November 1, 2026, DeFi protocols implemented emergency blocklists after the FBI, U.S. Secret Service, and IRS Criminal Investigation issued an advisory targeting more than 600 attacker-controlled addresses. Authorities attributed the attack to North Korea's TraderTraitor group, which converted assets into ETH and routed funds through lending markets including Aave. The Ethereum reorg caused THORChain to issue a duplicate refund on a 10 ETH deposit, triggering an emergency halt that froze bridge activity.
Addressing law enforcement alerts to freeze hacker wallets, THORChain co-founder Chad Barraford said node operators held no private data beyond real-time public records. Barraford stated on social media that no subpoenas were required for investigations.
Key facts
- Ethereum reorg caused pause
- Double refund on 10 ETH deposit
- 600+ addresses targeted by FBI
- Swaps halted across 10 networks
Read the original at CryptoSlate