Key Highlights
- Chainalysis reported that an Ethereum reorganization caused THORChain to issue a duplicate refund following a 10 ETH deposit.
- The incident triggered an emergency pause, temporarily halting cross-chain swaps across most of THORChain’s bridges.
- Chainalysis said the suspension interrupted laundering activity involving funds stolen in the $6.3 billion Binance hack.
THORChain has temporarily halted cross-chain swaps after an Ethereum reorganization disrupted its refund process, according to blockchain analytics firm Chainalysis.
In an October 31 post on X, Chainalysis said the incident involved a user who deposited 10 ETH and received a duplicate refund. The resulting discrepancy triggered THORChain’s emergency pause.
Chainalysis said the suspension also interrupted the movement of funds stolen in the $6.3 billion Binance hack, which the firm linked to North Korean money-laundering activity.
Ethereum reorganization triggers THORChain emergency pause
An Ethereum reorganization occurs when a network replaces part of its previously recorded transaction history with an alternative chain. Transactions that appeared confirmed in the earlier version may no longer be included in the canonical chain.
According to Chainalysis, an Ethereum reorganization on October 31 led to THORChain issuing a duplicate refund after a user deposited 10 ETH.
The firm did not provide further technical details about the affected transaction or explain the precise amount involved in the duplicate refund.
Emergency pause blocks cross-chain swaps
The suspension affected most of THORChain’s cross-chain swap routes, preventing users from moving assets through the affected connections.
The restriction applied to all users, not just wallets associated with the Binance hack, and affected legitimate cross-chain transactions as well. Chainalysis did not specify whether individual connections could resume operations before the wider protocol returned online.
The Crypto Times has reached out to THORChain and Chainalysis for comment on the Ethereum reorganization, the emergency pause and the reported impact on funds linked to the Binance hack.
Chainalysis says pause disrupted Binance hack laundering
Chainalysis described the emergency pause as an interruption to laundering activity involving cryptocurrency stolen from Binance.
“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” the firm wrote.
It added that the pause prevented North Korean-linked actors from using THORChain’s cross-chain swaps while the service remained offline.
However, Chainalysis did not disclose how much of the stolen cryptocurrency was affected or how much had already moved through the protocol.
The pause interrupted the reported route, but Chainalysis did not say that the affected funds had been recovered or permanently blocked.
X users debate the impact of the pause
In an October 31 post on X, William Clay (@williamclay) summarised the incident as a 10 ETH double refund that temporarily disrupted a route allegedly used to launder funds from the Binance hack. He said the emergency pause prevented users, including hackers, from swapping through most of THORChain’s bridges until the service reopened.
Another X user, Patriotsounds (@patriotsounds), challenged the suggestion that THORChain provides an effective laundering route. The user argued that transactions through the protocol remain traceable and described THORChain as a layer-1-to-layer-1 system rather than a conventional bridge.
Patriotsounds also argued that the emergency pause was an automatic protocol response rather than a manually imposed restriction. The user did not provide technical evidence for this explanation.
These comments reflect individual views and do not independently establish how the incident affected the movement or traceability of the stolen funds.
How Binance hack funds have moved
The THORChain disruption comes as blockchain analytics firms continue tracking funds linked to the Binance breach. Earlier reporting by The Crypto Times identified several routes used to move the stolen assets.
TRM Labs found that laundering activity following the Bybit hack relied heavily on cross-chain bridges. In the Binance incident, the attacker reportedly used a combination of decentralized trading and lending services.
The attacker sold approximately 325 million USDT through UniswapX at a discount of more than 10%, borrowed ETH against USDT on Aave and supplied USDT to JustLend on Tron, according to an earlier The Crypto Times report.
In a separate report, The Crypto Times traced activity involving a wallet that supplied 60 million USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH, valued at approximately $44.6 million at the time.
These reports describe different stages of fund movements linked to the Binance breach.
THORChain’s return to service remains unclear
Chainalysis did not provide a reopening time or detail the steps required to resolve the duplicate-refund issue.
THORChain’s restoration timeline and the status of the affected funds remain unclear.
Also Read: b14g Probes 97M CORE Withdrawal as Exchanges Freeze 9M Tokens