THORChain Freezes Swaps on 10 Blockchains as Ethereum Bug Disrupts Binance Hackers

THORChain suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum block reorganization exposed a critical refund vulnerability. The disruption affected major networks, including Bitcoin, Ethereum, Solana, and Tron.

The emergency shutdown on October 31 also disrupted efforts by North Korean hackers to move stolen Binance funds. Blockchain analytics firm Chainalysis said the unexpected suspension temporarily restricted access to cross-chain services used to transfer illicit cryptocurrency.

Ethereum Reorganization Exposes Refund Vulnerability

The incident began at approximately 11:34 UTC on Saturday when Ethereum experienced a one-block reorganization. The event removed a 10 ETH deposit that THORChain had already recognized.

When the associated transaction failed to satisfy its price requirements, THORChain processed a refund despite never receiving the original funds. The system also refunded the sender’s actual deposit, resulting in an additional 10 ETH payout.

The discrepancy triggered THORChain’s automatic security protections, prompting node operators to suspend trading across multiple networks.

A blockchain reorganization occurs when a network replaces a recently confirmed block with an alternative version. Although such events can occur during normal blockchain operations, they create risks for protocols that process transactions before final settlement.

THORChain warned that attackers could potentially exploit similar discrepancies during future reorganizations.

Binance Hackers Face Unexpected Disruption

The suspension also complicated efforts to move cryptocurrency stolen during the recent $6.3 billion Binance security breach.

According to Chainalysis, North Korean hackers had been using cross-chain infrastructure to transfer stolen assets between blockchain networks. THORChain’s emergency restrictions temporarily prevented those transfers through most of its supported networks.

The FBI previously identified North Korea’s TraderTraitor operation as responsible for the Binance attack. U.S. authorities subsequently urged decentralized finance platforms and cryptocurrency service providers to restrict transactions involving identified wallet addresses.

However, THORChain’s suspension affected legitimate users alongside suspected illicit actors.

THORChain Faces Security and Decentralization Challenges

The incident highlights the operational risks facing decentralized cross-chain liquidity protocols. These platforms allow users to exchange assets across independent blockchain networks without relying on traditional centralized exchanges.

Trading remained available on Avalanche, Base, and XRP Ledger while operators assessed the affected networks.

THORChain said node operators would determine when individual networks could safely resume trading.

The disruption also renewed questions about how decentralized protocols should respond when criminals exploit permissionless financial infrastructure.

For now, the incident underscores the importance of transaction finality, reliable refund mechanisms, and automated security controls in protecting cross-chain cryptocurrency markets.