{"id":37779,"date":"2026-11-02T09:52:55","date_gmt":"2026-11-02T09:52:55","guid":{"rendered":"https:\/\/bitunikey.com\/news\/thorchains-10-eth-refund-error-disrupts-binance-hackers-transfers\/"},"modified":"2026-11-02T09:53:11","modified_gmt":"2026-11-02T09:53:11","slug":"thorchains-10-eth-refund-error-disrupts-binance-hackers-transfers","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/thorchains-10-eth-refund-error-disrupts-binance-hackers-transfers\/","title":{"rendered":"THORChain\u2019s 10 ETH refund error disrupts Binance hackers\u2019 transfers"},"content":{"rendered":"<p><\/p>\n<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 billion Binance hack.<\/p>\n<div id=\"cn-block-summary-block_f18932151c953591ca21402dd1d5cea8\" class=\"cn-block-summary\">\n<div class=\"cn-block-summary__nav tabs\">\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/div>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>THORChain suspended swaps on 10 blockchain networks after an Ethereum block reorganization caused an incorrect 10 ETH refund.<\/li>\n<li>The protocol\u2019s automatic solvency checker detected the missing funds and halted Ethereum swaps before node operators paused additional chains.<\/li>\n<li>THORChain said the recipient returned the extra 10 ETH, restoring the affected vault\u2019s balance.<\/li>\n<li>Chainalysis reported that the interruption temporarily delayed cross-chain transfers linked to the $6.3 billion Binance hack.<\/li>\n<li>The FBI has urged THORChain operators and other crypto services to block transactions connected to North Korea\u2019s TraderTraitor group.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>According to a November 2 statement, the cross-chain protocol encountered a refund problem following an Ethereum block reorganization on October 31. Its security systems detected a missing 10 ETH payment and halted Ethereum swaps before node operators suspended trading on other networks.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">On October 31, THORChain halted trading on several blockchains.<\/p>\n<p>An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators\u2026<\/p>\n<p>\u2014 THORChain (@THORChain) <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/THORChain\/status\/2117011632757092501?ref_src=twsrc%5Etfw\">November 1, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>Blockchain analytics firm Chainalysis said the interruption prevented users, including suspected North Korean money launderers, from accessing most of THORChain\u2019s cross-chain services.<\/p>\n<h2 class=\"wp-block-heading\"><strong>THORChain halts swaps after 10 ETH refund error<\/strong><\/h2>\n<p>The incident began at 11:34 UTC on October 31, when Ethereum underwent a one-block reorganization that removed a recent transaction from its accepted blockchain history.<\/p>\n<p>The affected transaction involved a 10 ETH deposit intended for a THORChain vault. Although Ethereum subsequently removed the deposit, THORChain had already recognized the incoming payment.<\/p>\n<p>The associated swap failed to meet the sender\u2019s specified price limit, prompting the protocol to issue a refund.<\/p>\n<p>However, because the original deposit was no longer recorded on Ethereum\u2019s accepted chain, THORChain sent 10 ETH from a vault that had not received the corresponding funds.<\/p>\n<p>The sender\u2019s actual deposit was refunded separately, resulting in an additional 10 ETH payout.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<p>THORChain said its automatic solvency checker detected the difference between recorded and available funds, immediately suspending Ethereum swaps.<\/p>\n<p>Within roughly two minutes, node operators stopped outbound Ethereum transaction signing to prevent further withdrawals from the affected vaults.<\/p>\n<p>The team subsequently paused other connected networks while developers examined the problem.<\/p>\n<p>According to the protocol, the recipient returned the extra 10 ETH, restoring the vault\u2019s balance.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Bitcoin and Ethereum among 10 affected networks<\/strong><\/h2>\n<p>The emergency response affected swaps involving Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash.<\/p>\n<p>Trading remained available on Avalanche, Base and XRP Ledger, alongside THORChain\u2019s native network.<\/p>\n<p>The protocol\u2019s <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/thorchain.net\/network\" target=\"_blank\">network dashboard<\/a> provides the operational status of supported blockchains as node operators assess when services can resume.<\/p>\n<p>THORChain explained that the problem arose because its systems initially accepted a deposit that Ethereum later removed during the block reorganization.<\/p>\n<p>An Ethereum reorganization occurs when the network replaces a recent block with another version of its transaction history.<\/p>\n<p>In this case, the discrepancy allowed THORChain\u2019s refund process to recognize funds that were no longer present in the accepted Ethereum record.<\/p>\n<p>The team warned that a similar issue could potentially occur following reorganizations on other supported blockchains.<\/p>\n<p>According to THORChain, an attacker could exploit the problem by submitting another transaction using the same nonce after an earlier deposit disappeared from the accepted chain.<\/p>\n<p>Developers are preparing changes intended to prevent the refund process from treating discarded transactions as completed deposits.<\/p>\n<p>The protocol said node operators would determine when individual chains were safe to reopen.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Chainalysis says pause disrupted Binance hackers<\/strong><\/h2>\n<p>The trading interruption occurred as blockchain investigators continued tracing funds stolen from Binance during the October 29 security breach.<\/p>\n<p>Chainalysis said the technical failure had inadvertently delayed the movement of assets linked to the attack.<\/p>\n<p>The company explained that the emergency pause stopped ordinary users and suspected money launderers from accessing most of THORChain\u2019s cross-chain swapping routes.<\/p>\n<p>Earlier, the FBI <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.fbi.gov\/investigate\/cyber\/alerts\/2026\/north-korea-responsible-for-6-billion-binance-attack\" target=\"_blank\">attributed the Binance attack<\/a> to North Korea\u2019s state-sponsored TraderTraitor group.<\/p>\n<p>In its October 31 notice, the agency said the attackers had been converting stolen cryptocurrency primarily into Ethereum before attempting further transfers through decentralized finance and instant-swap services.<\/p>\n<p>The FBI urged THORChain node operators, exchanges, blockchain infrastructure providers and other virtual asset businesses to block transactions involving identified attacker addresses.<\/p>\n<p>The agency published a list of cryptocurrency wallets associated with the stolen funds to help service providers identify suspicious transfers.<\/p>\n<p>However, THORChain\u2019s October 31 shutdown resulted from its own technical safeguards, not a decision to selectively block the Binance attackers.<\/p>\n<h2 class=\"wp-block-heading\"><strong>THORChain has faced earlier disputes over stolen funds<\/strong><\/h2>\n<p>The latest interruption follows previous disagreements over whether THORChain should restrict transactions involving stolen cryptocurrency.<\/p>\n<p>In September, Bitget asked the protocol to block identified hacker addresses following a $387.5 million security breach.<\/p>\n<p>THORChain rejected the request, arguing that its emergency shutdown mechanisms were intended to protect network operations, not freeze individual transactions.<\/p>\n<p>Security firm GoPlus subsequently questioned the protocol\u2019s decentralization, pointing to the ability of validators to pause trading and control outbound signing during emergencies.<\/p>\n<p>Earlier in October, independent researcher Andrey Sergeenkov traced fees generated through transactions involving assets stolen from Bitget.<\/p>\n<p>His analysis found that THORChain liquidity providers received $573,226 in fees from the reviewed transactions, while additional affiliate payments reached addresses with varying degrees of connection to the stolen-fund movements.<\/p>\n<p>THORChain experienced a separate security incident in May when a compromised vault lost approximately $10.7 million.<\/p>\n<p>Following that attack, the protocol introduced security changes and an 11-step restart plan before restoring trading in June.<\/p>\n<p>Founder John-Paul Thorbjornsen <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/jpthor\/status\/2116805071082303736?a=RZByQx0YdByaepfv9PM&amp;s=20\" target=\"_blank\">defended<\/a> the network\u2019s permissionless design, warning that permanently shutting down THORChain over demands to block illicit transactions would undermine its operating principles.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 billion Binance hack. Summary THORChain&hellip;<\/p>\n","protected":false},"author":1,"featured_media":29835,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-37779","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/37779","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=37779"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/37779\/revisions"}],"predecessor-version":[{"id":37780,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/37779\/revisions\/37780"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/29835"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=37779"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=37779"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=37779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}