10 ETH Deposit Halts THORChain Swaps Across Most Bridges After Ethereum Reorganization
Key Facts
THORChain suspended swaps across most of its bridges after an Ethereum reorganization caused a 10 ETH deposit to be refunded twice, according to a TokenPost report on the incident dated October 31, 2026. The report said the event involved a one-block reorganization, without explaining the technical failure or how the two refunds were processed. The suspension came as assets stolen from Binance were moving through Ethereum, according to a warning from the U.S. Federal Bureau of Investigation. TokenPost attributed to Chainalysis the claim that the halt disrupted a route linked to laundering Binance funds; this does not document a direct statement from the company in an independent source. The report did not specify how many bridges were affected or when swaps would resume.
In an alert published by the FBI, authorities said North Korea was responsible for stealing virtual assets worth more than $6 billion from Binance, in an incident that took place on or around October 29. The bureau said entities linked to the group known as TraderTraitor converted the stolen assets primarily to Ethereum. The FBI, along with the Secret Service and the Internal Revenue Service, also urged THORNode operators, RPC node operators, instant-swap services, the decentralized finance sector and virtual asset service providers to block transactions linked to, or derived from, addresses used by the attackers. The warning places the swap suspension in the context of routes used to move stolen assets, but does not establish that THORChain halted swaps in response to an intentional request from authorities. The Associated Press reported that the FBI had linked the same group to the Bybit breach, valued at $1.5 billion, in 2025.
THORChain's control architecture limits its ability to isolate a single transaction when a problem occurs; TokenPost said the network has no mechanism to block an individual swap, sender or recipient. Instead, node operators can halt a chain or the entire network, affecting users broadly. Official emergency procedures state that a halt command issued by one node lasts 720 blocks and that the suspension can be extended with another command. The documentation says a halt stops chain observation, swaps and signing of outbound transactions, making the measure broader than blocking a specific swap. Ethereum documentation defines a reorganization as a rearrangement of blocks that may involve adding or removing blocks from the canonical chain, changing the recent order of the ledger.
The incident followed THORChain's October 21 release of v3.21, which, according to its announcement, included enhanced recovery from network reorganizations as part of broader improvements to the stability of its Monero integration. Ten days later, TokenPost reported that an Ethereum reorganization was linked to a 10 ETH deposit being refunded twice. The report does not explain any link between the incident and v3.21 or clarify whether the improvements in the release covered this specific case. The available information also does not include an announced date for swaps to resume or confirmed details on how the failure was addressed. Those questions remain tied to what the network announces about its operational response and post-incident fix.
The incident came after a strong quarter for activity, according to THORChain's third-quarter report: trading volume reached about $3.82 billion, while fees came to about $5.77 million, with both figures close to twice their second-quarter levels. September alone recorded trading volume of $2.41 billion, as funds linked to the Bitget breach moved through the network. The report said volume and fees remained above second-quarter levels even after excluding the five days linked to those funds. Total liquidity also rose from $54.58 million to $89.82 million during the quarter. These figures show the scale of activity and liquidity before the October suspension, without establishing the later incident's effect on financial or operational performance.
The network had faced another operational halt on August 26 and 27, after nodes disagreed over the state of the network, according to its quarterly report. An urgent fix followed in release v3.20.1, and the application layer remained halted until it resumed by September 3. The report links the August halt to disagreement among nodes, while the October suspension was linked to an Ethereum reorganization and a 10 ETH deposit being refunded twice. The incidents reveal two different types of reported disruption within a few months, without the public source specifying the duration of the October halt. The incident report gives no subsequent service-resumption date; the only clear timeline in the available information is the emergency halt command and the network procedures allowing it to be extended.
In the market, EL7 data showed RUNE closing at $0.631 on October 31 and $0.576 on November 1. The two figures cover the day of the incident and the following day, but do not establish that the swap suspension caused the price movement. The available information did not include a measure of RUNE trading volume during that period or a comparison with other assets. Public sources also did not detail how many bridges were suspended or confirm that swaps had resumed. The resumption date and an update on addressing the failure remain among the key information awaited after the incident.