Key Takeaways
- A 10 ETH double refund triggered Thorchain’s emergency pause across 12 supported networks.
- Chainalysis identified an unexpected obstacle to laundering funds stolen from Binance.
- The FBI urged Thorchain operators to block transactions linked to North Korea’s Tradertraitor.
Ethereum Reorg Jolts Thorchain Into Emergency Shutdown
The trouble began when Ethereum reorganized a single block, effectively replacing a previously accepted segment of its transaction history. A 10 ETH deposit intended for a Thorchain vault appeared in the discarded block but never returned to Ethereum’s canonical chain. Thorchain’s observers had already recognized the deposit and credited the vault. When the associated swap failed its price conditions, the protocol refunded 10 ETH that the vault had never actually received.
Another deposit from the same wallet was subsequently refunded, leaving the vault approximately 10 ETH short. The discrepancy activated Thorchain’s automatic solvency protections, which halted its Ethereum processing. There was no evidence of malicious intent behind the transaction. Technical accounts attributed the incident to a collision between Ethereum’s reorganization and Thorchain’s deposit verification procedures.
Chainalysis Says Binance Hack Laundering Hit a Roadblock
The malfunction quickly snowballed into a broader operational disruption. Trading and new swaps stopped across 12 of Thorchain’s 13 supported external networks, although certain previously initiated outbound payments remained operational. Chainalysis seized on the irony, writing that Thorchain had “inadvertently delayed the laundering of a significant amount of funds stolen from Binance.”
Chainalysis added:
“One happened this morning and caused [Thorchain] to incorrectly issue a double refund to someone who had deposited 10 ETH. This triggered an ’emergency pause’ on [Thorchain], preventing all users, including DPRK’s money launderers, from using cross-chain swaps. Until the service comes back online, neither the hackers nor anyone else can swap through a majority of [Thorchain]’s bridges.”
The blockchain intelligence firm explained that the emergency pause prevented ordinary customers and suspected North Korean money launderers alike from accessing most of Thorchain’s cross-chain swapping routes. The disruption followed Binance’s Oct. 29 breach, which investigators attributed to North Korea’s Tradertraitor operation. Blockchain analysts had identified stolen funds moving through Thorchain-associated routes, including activity connected to earlier cryptocurrency thefts.
Yet the interruption was neither a targeted asset freeze nor a permanent blockade. Thorchain’s safeguards had reacted to an accounting problem, not the origin of incoming cryptocurrency.
FBI Presses Thorchain Node Operators to Block North Korean Funds
While developers investigated the malfunction, federal authorities were pursuing a separate approach. The FBI, working alongside the U.S. Secret Service and IRS Criminal Investigation, issued an Oct. 31 alert urging infrastructure providers to prevent transactions involving wallets connected to the Binance theft. Its appeal explicitly named Thorchain node operators, alongside RPC providers, instant exchanges, decentralized finance (DeFi) services and blockchain analytics firms.
The request was voluntary rather than a court order. It nevertheless placed fresh scrutiny on a permissionless protocol whose operators have previously resisted selective transaction blocking. Thorchain technical co-founder Chad Barraford responded that operators possessed publicly accessible information, describing the situation as “No subpoenas required, a best-case scenario for investigations.” His remarks addressed investigators’ access to information rather than whether operators would comply with the transaction-blocking request.
A 10 ETH Accounting Error Complicates a Multibillion-Dollar Heist
The episode exposed a peculiar contradiction in cross-chain infrastructure. A system designed to move cryptocurrency without centralized permission briefly became unavailable because its own accounting protections detected a missing deposit. Developers planned changes to observation and finalization procedures while addressing the affected vault’s shortfall. The interruption lasted several hours, with restoration proceeding across individual chains.
The FBI’s request remained a separate matter. Even if Thorchain’s software safeguards can stop entire networks, selectively refusing transactions associated with particular wallets presents a different technical and governance problem. For a few hours, a misplaced 10 ETH accounting credit accomplished what a federal appeal had not demonstrably achieved: It shut a major swapping route to everyone, including suspected North Korean money launderers.
