THORChain Pauses Swaps on 12 of 13 Chains After Ethereum Reorg Refund
An Ethereum reorganization led THORChain to refund the same 10 ETH deposit twice, tripping an emergency pause that froze swaps on 12 of 13 chains. Chainalysis says the halt slowed laundering of funds stolen from Binance, though the reorg, not policy, caused it.
One 10 ETH deposit, refunded twice, was enough to bring THORChain to a near standstill on October 31: an Ethereum reorganization led the protocol to pay the same refund a second time, and the resulting emergency pause halted trading and swaps on 12 of the 13 chains it supports.
A reorg, short for reorganization, happens when a blockchain replaces recently confirmed blocks with a competing version of the chain. Transactions that looked final can shift, disappear or show up again in a new position. For a cross-chain protocol like THORChain, which watches Ethereum and responds to deposits, that is a real hazard: if the history it saw gets rewritten, it can act on the same event twice. Think of a shop clerk who hands back change for a banknote, then sees the same note appear again in a reshuffled till and pays out a second time.
What triggered the halt
After the reorg, THORChain mistakenly refunded the 10 ETH deposit twice, and that duplicate payment tripped the protocol's emergency pause. Swaps remain paused on 12 chains.
The shutdown was not total. Outbound signing stayed enabled on most of the affected chains, so some payments could still go out even while new swaps were blocked.
How long it can last
A halt of this kind can run for up to 720 blocks, roughly 1.5 hours, and additional node votes can extend it. Three things are worth watching from here: whether node operators push the pause past 720 blocks, how the protocol deals with the extra 10 ETH it paid out, and whether THORChain changes the way it handles Ethereum reorgs.
The Chainalysis link
The pause also had a side effect that reaches well beyond one refund. Chainalysis linked the halt to funds stolen from Binance, tied the laundering activity to DPRK actors, and said the pause slowed efforts to launder those funds. On causation, though, the record is plain: the pause came from the reorg and the double refund, not from any deliberate move against the stolen funds.
That distinction matters given THORChain's earlier stance. The protocol refused to block $387M in Bitget hack funds, citing decentralization. A halt caused by a refund error is a different thing from a policy decision to freeze flows.
A system that caught its own mistake late
The emergency pause did what it was built to do, yet the second refund still went out. The safeguard worked after the error, not before it.
There is a structural point as well. Every chain THORChain adds is another potential point of failure, and an event on one network can force a pause across nearly the whole system, as happened here with 12 of 13 chains stopped. Nor is this the protocol's first operational halt of 2026: earlier this year it dealt with exploits and with halts linked to ZEC and TRON.
In dollar terms the cost of this one looks small, a single 10 ETH overpayment. The more durable question is how a multi-chain design copes when one of the chains it watches turns out to be less final than it assumed.
