THORChain News: Why Did 10 Chains Halt After an Ethereum Reorg?
THORChain News: How Did an Ethereum Reorg Trigger a 10 ETH Payout?
THORChain News today: THORChain halted trading on ten blockchains after an Ethereum reorg made its vaults pay out 10 ETH they never received. The user returned the 10 ETH, and the vault is solvent again. Node operators will re-enable chains as they judge them safe.
The FBI separately asked THORNode operators to block addresses tied to the Binance theft on the same day. THORChain has not linked the two events. This report keeps them apart.
What Happened During the Ethereum Reorg?
Time (UTC, October 31) | Event |
11:34 | A one-block Ethereum reorg drops a 10 ETH deposit THORChain had already credited |
After | The swap misses its price limit and is refunded. The vault pays 10 ETH it never received |
Automatic | The solvency checker halts Ethereum swaps |
About 2 minutes | Node operators halt ETH transaction signing |
Then | Three node votes halt ETH payouts, then all chains |
The sender's real deposit was refunded too. THORChain says every node detected the reorg, but the re-check that should have removed the deposit could not get a clear answer in time.
THORChain warns the flaw could repeat. On any external-chain reorg, someone could send a new transaction with the same nonce and be paid from the vaults.
Three node votes can trigger an emergency halt, and four counter votes can reverse it. THORChain says halting a chain does not give nodes control of assets.
Which Chains Are Halted and Which Are Live?
Status | Chains |
Trading | AVAX, BASE, RUNE, XRPL |
Halted | ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC |
Core developers are working on fixes. This THORChain News check found no re-enable date. THORChain says nodes will re-open each chain once it is judged safe. No user fund loss was reported in the sources reviewed.
CoinMarketCap data showed RUNE at $0.5044 on the morning of November 2, down 19.84% in 24 hours. THORChain's account does not link the move to the halt.
Earlier reports described a separate emergency halt on May 15, 2026, during a suspected exploit of roughly $10 million. That is context, not part of this incident.
THORChain News: How Does the FBI Alert Connect to the Halt?
On October 31, the FBI attributed the theft of more than $6 billion from Binance, on or about October 29, to North Korea's Lazarus group. The FBI, USSS and IRS-CI urged THORNode operators, RPC operators, exchanges and DeFi services to block transactions with or derived from listed addresses. The FBI says the actors have mostly converted stolen assets into Ethereum .
The alert is a request, not an order. The reactions so far:
Chainalysis: says the halt inadvertently delayed laundering, because neither the hackers nor anyone else can use most THORChain swaps while it lasts
Chad Barraford: the THORChain co-founder says node operators hold no non-public information, so investigators need no subpoenas
John-Paul Thorbjornsen: the founder argues that shutting the protocol down would end its purpose
Whether node operators will block the listed addresses has not been stated.
The Bottom Line
This THORChain News review finds a contained 10 ETH incident, ten chains still halted and no re-enable date. THORChain's own account does not tie the halt to the Binance funds. Check chain status before swapping.
YMYL Disclaimer: This article is for information purposes only and is not financial, investment, or trading advice. Information is based on THORChain's posts as supplied, the FBI's October 31, 2026 alert as quoted in indexed copies, statements by Chainalysis and THORChain's founders and CoinMarketCap data, as of November 2, 2026. Chain status can change at any time. Allegations and attributions are those of the named parties. No wrongdoing by THORChain is alleged. Crypto assets are volatile and carry risk of loss, including full loss of funds. Always verify current details directly with official sources and consult a licensed advisor before making investment decisions.
