THORChain activated its emergency brake after an Ethereum reorganization caused the protocol to issue a duplicate refund on a 10 ETH deposit. The incident halted trading and swaps across 12 of the 13 chains that the protocol supports.
What Triggered the Halt
On October 31, 2026, Ethereum underwent an unexpected reorganization, a process in which the network swaps recently confirmed blocks for a competing chain of blocks. Transactions that appeared final can shift, disappear, or reappear in a new position.
For a cross-chain protocol that monitors Ethereum and responds to deposits, a reorganization presents a significant problem. If the transaction history changes, the protocol can act on the same event twice. In this case, THORChain processed a single 10 ETH deposit twice, issuing two refunds instead of one.
The duplicate refund triggered the protocol's emergency pause mechanism, freezing trading and swaps across most of its supported chains. Outbound signing remained active on most affected chains, allowing some transactions to proceed while swaps were frozen.
How the Emergency Pause Works
THORChain is operated by node operators whose rules permit them to prioritize network integrity over uptime during investigations. An emergency halt can last up to 720 blocks, approximately 1.5 hours, and node votes can extend the pause beyond that window.
The Binance Connection
Chainalysis, a blockchain analytics firm, linked the emergency halt to funds stolen from Binance. The firm connected the laundering activity to actors associated with North Korea. While the pause was triggered by the Ethereum reorg and double refund rather than a deliberate action against the stolen funds, the timing delayed any effort to move those assets quickly across chains—a common technique for obscuring the origin of stolen money.
Broader Implications
The incident underscores both the strengths and limitations of THORChain's safety mechanisms. The emergency pause functioned as designed by detecting an anomaly and halting activity before additional damage could occur. However, the double refund was already processed before the protocol detected the error.
This points to a central challenge for cross-chain liquidity protocols: their reliability is constrained by how effectively they manage bad data from connected blockchains, including temporary data that may later be reversed by a reorganization.
THORChain is run as a decentralized liquidity network using its native RUNE token. The protocol offers native cross-chain swaps without relying on a centralized exchange. However, each additional chain it supports represents another potential point of failure, and an event on a single chain can force a pause across nearly the entire network.
The incident also raises ongoing questions about how decentralized protocols should respond when stolen funds pass through their systems. This was not THORChain's first operational halt in 2026, as the protocol previously dealt with exploits and halts linked to ZEC and TRON.
