Crypto

THORChain Halts Most Swaps After Ethereum Reorg Bug, Slowing Binance Hack Laundering; RUNE Falls 14%

A refund bug triggered by a one-block Ethereum reorganization halted most THORChain swaps over the weekend, which Chainalysis said delayed laundering of funds stolen from Binance. RUNE fell about 14%.

Nov 02, 2026 - 07:19

0 2

THORChain, a protocol used to swap native cryptocurrencies across blockchains, paused trading on most of its supported networks over the weekend after a one-block Ethereum reorganization exposed a refund bug. Blockchain analytics firm Chainalysis said the halt also slowed efforts by North Korean hackers to launder funds stolen in last week's Binance breach.

THORChain's native token, RUNE, traded at about $0.53 at about 7:05 a.m. ET on Monday, November 2, 2026, down about 14% over 24 hours, according to CoinGecko data.

What went wrong

According to THORChain, the incident began at 11:34 UTC on Saturday, October 31, when a reorganization on Ethereum removed a 10 ETH deposit that THORChain had already credited, Cointelegraph reported. A reorganization, or reorg, happens when a network replaces a recent block with a competing one. When the related swap failed to meet its price limit, THORChain refunded funds its vault had never received, and the sender's real deposit was also refunded, producing an extra 10 ETH payout that triggered an automatic pause.

"Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults," the protocol's team said, according to Cointelegraph.

Node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP, according to the protocol's network status page as cited by Cointelegraph. Bitcoin.com News reported there was no evidence of malicious intent behind the original transaction. CryptoTicker reported on Monday that the 10 ETH paid out in error had been returned and the affected vault was solvent again, with node operators deciding when to restart each network.

An unplanned obstacle for the hackers

"THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance," Chainalysis said on Sunday. "Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain's bridges."

On Saturday, the FBI, working with the U.S. Secret Service and IRS Criminal Investigation, issued an alert attributing the theft of more than $6 billion from Binance to North Korea's TraderTraitor activity and urging THORNode operators and other virtual asset service providers to block transactions "with or derived from" addresses tied to laundering the funds, TokenPost reported. The agencies published 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, according to CryptoTicker, citing The Block. The request was voluntary rather than a court order, Bitcoin.com News noted.

THORChain co-founder Chad Barraford said on X that node operators have no information that is not already public, The Block reported. Founder John-Paul Thorbjornsen, known as JP Thor, defended the protocol's permissionless design. "IMO if THORNodes decided to take the protocol offline next week then the experiment is over," he wrote.

Where the stolen funds have gone

On-chain analyst SomaXBT, who works with the security alliance SEAL, estimated that about $242 million was laundered on Tron within two days, The Block reported. The attackers had taken about $628 million on that blockchain, of which stablecoin issuer Tether froze 378.7 million USDT. Of the $242 million, about $194 million left Tron through bridges and swap services, including about $44 million through THORChain. Before the halt, THORChain paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses, according to the analysis.

Analytics firm Elliptic counts $6.43 billion in stolen assets, of which $2.85 billion, or about 44%, has been frozen or seized, CryptoTicker reported, citing The Block. About $3.25 billion sits in assets that no issuer can freeze, including 18,327 BTC.

Market reaction

RUNE closed at about $0.634 on October 31 and has fallen more than 97% from its all-time high of $20.87 in May 2021, according to CoinGecko and Yahoo Finance data. Bitcoin traded near $77,800, little changed over 24 hours, and ether was near $2,284 at about the same time Monday, CoinGecko data showed. Binance resumed withdrawals in phases on November 1, TokenPost reported.