An Ethereum reorganization on Saturday replaced a previously accepted block, leaving a 10 ETH deposit recorded by Thorchain but never actually received on the main chain. Thorchain’s system credited the deposit, and when the associated swap failed, the protocol issued a refund for the missing 10 ETH. A second refund from the same wallet created a shortfall, activating Thorchain’s solvency safeguards and prompting an emergency pause of Ethereum processing.
The pause extended to 12 of Thorchain’s 13 supported external networks, stopping new swaps and trading across those chains. Chainalysis noted that the interruption unintentionally delayed the laundering of funds linked to the October 29 Binance theft, which investigators have tied to North Korea’s Tradertraitor operation.
Separately, the FBI, together with the U.S. Secret Service and IRS Criminal Investigation, issued an alert on October 31 urging infrastructure providers—including Thorchain node operators—to block transactions involving wallets connected to the Binance breach. The request was voluntary and not backed by a court order. Thorchain co‑founder Chad Barraford said operators have public information to identify such wallets.
Developers are reviewing Thorchain’s observation and finalization procedures to prevent similar accounting errors. The service began restoring operations on individual chains after several hours of downtime.
