On Saturday, a single‑block reorganization on Ethereum caused Thorchain to mistakenly issue a double refund of 10 ETH, activating its automatic solvency protection and triggering an emergency pause across most of its cross‑chain bridges. The pause stopped new swaps on 12 of Thorchain’s 13 supported external networks, disrupting both ordinary users and suspected money‑launderers linked to the recent Binance theft. The incident also gave U.S. law‑enforcement a rare opportunity to press the decentralized protocol’s operators to block transactions tied to North Korean hackers.

ETH / USD
出典：CoinGecko。価格は参考値です。

Technical glitch behind the pause

According to Bitcoin.com, the Ethereum reorg replaced a previously accepted block that contained a 10 ETH deposit intended for a Thorchain vault. The deposit was recorded by Thorchain’s observers and credited to the vault, but when the block was orphaned the ETH never arrived on the canonical chain. A subsequent swap failed its price condition, prompting Thorchain to refund the 10 ETH that it believed it had received. A second deposit from the same wallet was also refunded, leaving the vault short by roughly 10 ETH. The protocol’s built‑in accounting safeguards interpreted the shortfall as a solvency risk and automatically halted Ethereum processing, extending the pause to other supported chains.

Chainalysis noted that the emergency pause unintentionally delayed the laundering of funds stolen in Binance’s October 29 breach, which investigators attribute to North Korea’s Tradertraitor operation. The firm said the pause prevented both regular users and the suspected North Korean actors from using Thorchain’s bridges, effectively creating a temporary roadblock for the illicit flow of the stolen assets. No evidence of malicious intent was found in the double‑refund transaction itself; the disruption was purely a result of the accounting error.

FBI request to Thorchain operators

Separate from the technical issue, the FBI, in coordination with the Secret Service and IRS Criminal Investigation, issued an alert on October 31 urging Thorchain node operators—and other DeFi infrastructure providers—to block transactions involving wallets linked to the Binance theft. The appeal was voluntary, not a court order, and specifically named Thorchain as a target for transaction‑blocking measures. Thorchain co‑founder Chad Barraford responded that operators have public information needed to comply, emphasizing that no subpoenas were required. While the FBI’s request remains a policy matter, the accidental pause demonstrated that Thorchain’s safeguards can halt activity for all participants, including the targeted hackers.

What to watch next