A 10 ETH Double-Refund Accidentally Jammed North Korea's $6.3B Binance Loot Route: THORChain Halted 12 of 13 Chains

One duplicate refund worth just 10 ETH — roughly $22,700 at current prices — accidentally jammed one of the escape routes North Korea's hackers were using to launder the $6.3 billion stolen from Binance. On October 31, 2026, an Ethereum chain reorganization caused THORChain to refund the same 10 ETH deposit twice, tripping the cross-chain protocol's emergency brake and halting swaps on 12 of its 13 connected chains. According to blockchain analytics firm Chainalysis, the halt landed squarely on funds tied to the Binance theft — and slowed the laundering operation at the exact moment it was running at full speed.

This is not a story about a heroic freeze or a protocol standing up to hackers. THORChain did not choose to block anyone. The pause was an accident, it was partial, and it was temporary. But accidents can matter: at the time the brake tripped, the attackers had already pushed about $242 million of Binance loot through the Tron blockchain in just two days, and the route through THORChain was one of their busiest exits. Here is what actually happened, what the halt did and did not do, and what comes next for the stolen billions.

How a 10 ETH Refund Stopped 12 Blockchains

THORChain is a decentralized cross-chain exchange: users deposit crypto on one blockchain and receive a different asset on another, with the protocol's vaults and nodes handling the swap in between. Because it connects chains that otherwise cannot talk to each other, it is one of the most-used tools for moving value quickly across ecosystems — by ordinary traders, and by criminals trying to break the trail of stolen funds.

On Saturday, October 31, Ethereum went through a chain reorganization — a "reorg" — in which recently confirmed blocks are replaced by a competing version of the chain. Reorgs are a normal, if uncommon, feature of blockchain consensus. This one had an abnormal consequence: THORChain's system read the reorganized history and refunded the same 10 ETH deposit a second time. A duplicate payment is exactly the kind of accounting anomaly the protocol's safety systems are designed to catch, and it did: the emergency pause engaged automatically.

Swaps froze on 12 of the 13 chains THORChain supports, including Tron, Ethereum and Bitcoin. Trading from Tron had been halted since around midday Saturday, and as of 1:20 p.m. ET on Sunday, trading remained halted on 10 of the 13 chains, according to THORChain node data cited by The Block. The shutdown was not total: outbound signing stayed active on most of the affected chains, meaning some transactions could still leave the protocol even while new swaps were blocked. A halt of this kind can last up to 720 blocks — roughly 1.5 hours — and node votes can extend it.

Independent coverage from Crypto Briefing and TokenPost confirmed the same sequence: reorg, duplicate refund, emergency pause — and the same Chainalysis link between the halted route and the Binance loot.

The timing is what turned a routine safety event into a major story. Chainalysis linked the interrupted route to funds stolen from Binance and tied the laundering activity to actors associated with North Korea. The pause, the firm said, delayed the laundering operation. It did not recover anything, and it did not seize anything — but for hours, one of the hackers' favorite exits was closed.

The $242 Million Laundering Machine It Interrupted

To understand why the pause mattered, look at the scale and speed of the operation it interrupted. Binance lost about $6.3 billion on Thursday, October 29, in the largest crypto hack on record. The FBI, together with the U.S. Secret Service and IRS Criminal Investigation, attributed the theft on Saturday to TraderTraitor, the North Korean state-sponsored hacking group active since at least 2020.

Onchain analyst SomaXBT, a contributor to the Security Alliance (SEAL), reported on Sunday that the hackers had laundered about $242 million of the Binance loot via the Tron blockchain in just two days. The attackers took roughly $628 million from Binance on Tron. After Tether froze 378.7 million USDT, about $249 million remained to be moved — and most of the $242 million that did move left Tron through bridges and swap services.

The breakdown of where it went, per SomaXBT's analysis, shows why THORChain's accidental halt was so consequential:

Route	Amount moved
Relay bridge	$48 million
THORChain	$44 million
Chainflip	$32.1 million
Symbiosis	$16 million
Other bridges and swaps	~$54 million

THORChain was the second-largest single exit in that flow. The operation was industrial in pace: blockchain analytics firm Elliptic reported that the hackers' main Tron distribution wallet paid out every hour for 31 straight hours and never paused for longer than 46 minutes. The same swap amounts kept recurring in THORChain deposits — one of them 19 times. When a bridge rejected deposits, new wallets automatically re-sent the funds to the same destination. This was not a person clicking buttons; it was an automated pipeline, and the THORChain pause threw a wrench into it.

For the full background on the hack itself and the FBI's attribution, read our coverage of how the FBI named North Korea in the $6.3B Binance hack, and if you hold funds on the exchange, our guide on how to withdraw crypto from Binance after the hack.

What the FBI Asked For — and Why THORChain Cannot Do It

The FBI's October 31 alert urged a long list of crypto services to block transactions tied to the theft: THORNode operators, RPC node operators, instant exchanges, DeFi services, analytics firms and other virtual-asset providers. The agency said the hackers were converting stolen assets primarily into Ethereum and expected further laundering through DeFi protocols and instant-swap services. It published a list of 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address linked to the attack.

Notice what is missing from that list: Tron addresses. The FBI published none, even though the Tron route was moving hundreds of millions. That gap matters, because the services being asked to block transactions work from lists — and a route that is not on the list is much harder to stop.

THORChain has a deeper structural problem with the FBI's request. The protocol can pause a chain or the whole network for safety, but it has no mechanism to remove or block a single swap. THORChain said exactly that in an October 1 post, before the Binance theft, and repeated it in its October 23 quarterly report. Its developer documentation describes several kinds of pause — stopping trading, stopping outbound signing, halting a chain — and every one of them catches every user of that route, not only the attacker.

THORChain technical co-founder Chad Barraford wrote on X on Saturday evening that "THORNode operators have zero information that isn't already public and readily available in real time." Translation: node operators cannot see anything the public cannot, and they cannot surgically pick out hacker transactions even if they wanted to. The protocol's design gives them a blunt instrument — halt everything — or nothing at all.

That design choice has a history. THORChain previously refused to block $387 million in funds from the Bitget hack, citing decentralization. A halt caused by a refund error is a different thing from a policy decision to freeze flows, and the distinction is the whole story of this weekend: the protocol that would not block hackers on principle ended up blocking them by accident.

5 Myths Traders Get Wrong About the THORChain Halt

The headlines make this sound cleaner than it was. Here are the five misunderstandings spreading fastest — and the reality behind each.

Myth 1: THORChain froze the hackers' funds. It did not. The pause stopped new swaps on most chains; it did not seize, freeze or return any stolen assets. Delayed funds are not recovered funds. The $44 million that already passed through THORChain before the halt is gone down the laundering pipeline, and the roughly $249 million still to move on Tron can resume moving the moment swaps reopen.

Myth 2: The halt was a deliberate anti-hacker move. It was triggered by an Ethereum reorg and a duplicate 10 ETH refund — an operational fault, not a policy decision. Chainalysis was explicit on causation: the pause came from the reorg and the double refund, not from any deliberate move against the stolen funds. Had the reorg happened on a quiet weekend with no hack in progress, the same brake would have tripped and nobody outside THORChain's community would have noticed.

Myth 3: Everything on THORChain stopped. It did not. Outbound signing stayed active on most affected chains, so some transactions could still go out while new swaps were frozen. The halt was a partial shutdown, not a full lockdown — and the distinction matters for anyone trying to measure how much laundering it actually prevented.

Myth 4: The FBI blocklist covers the whole laundering route. It does not. The published list contains 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address — but no Tron addresses, even though Tron carried the $242 million flow. Services that block only listed addresses would miss the busiest corridor entirely. The FBI's warning about conversion "primarily into Ethereum" describes where the funds are heading, not the only road they travel.

Myth 5: This proves decentralized protocols can stop hackers when they want to. It proves almost the opposite. The only thing that stopped the flow was an accident in THORChain's own accounting. The protocol's deliberate design choice is that it cannot target individual transactions — and its operators have publicly said they lack information beyond what is already public. If anything, the weekend demonstrated that decentralized cross-chain infrastructure has no precision tool for this problem, only a blunt emergency brake that punishes every user equally.

Why an Ethereum Reorg Can Double-Pay a Refund

A reorg happens when the network replaces recently confirmed blocks with a competing version of the chain — usually because two validators proposed blocks at nearly the same time and the network converges on one history. For most users, a reorg is invisible: their transaction simply lands in a slightly different block. For a cross-chain protocol, it is more dangerous, because the protocol's view of "what happened on Ethereum" can briefly disagree with Ethereum's final history.

In this case, THORChain's system processed a deposit, then processed the same deposit again after the reorg reshuffled the record — issuing a second refund of 10 ETH. The amount is trivial next to the billions in play, but the protocol's safety logic does not care about size: a duplicate payment signals that its internal accounting no longer matches reality, and the correct response is to stop and reconcile rather than keep swapping on bad data. That is exactly what the emergency pause is for, and it worked as designed. The uncomfortable part is that the same safety logic has no opinion about who the users are — it halts the hacker and the honest trader with equal indifference.

For ordinary users, the lesson is narrower but real: cross-chain bridges carry risks that have nothing to do with token prices. A reorg on one chain can freeze your swap on another, and a protocol's emergency brake can strand your funds for hours through no fault of your own. If you rely on bridges, keep amounts modest, avoid moving funds during network incidents, and understand the difference between a custodial exchange and a protocol that cannot reverse a transaction. Our guides to the best crypto wallets for beginners in 2026 and what a crypto wallet actually is explain how self-custody changes that risk picture.

What Happens Next: 3 Scenarios for the Stolen Billions

The pause will end. The laundering pipeline will not, on its own. Here are the three paths from here, ranked by likelihood.

Scenario 1 — Business as usual (most likely): THORChain resumes, the pipeline restarts. Swaps reopen, the automated wallets resume their hourly payouts, and the remaining Tron funds continue through bridges toward Ethereum and DeFi mixers. Tether freezes more USDT where it can, but the hackers have already shown they route around freezes within hours. In this scenario, the pause is remembered as a curious footnote — a few hours of delay in a multi-week laundering operation.

Scenario 2 — Voluntary blocking spreads (possible): node operators and bridges act. Under FBI pressure, some THORNode operators, bridge operators or RPC providers voluntarily block or refuse transactions tied to published addresses. This would slow specific corridors but not stop the flow: the Elliptic data shows the operation auto-retries through new wallets and alternative bridges the moment one route rejects it. Partial blocking raises the hackers' costs; it does not recover the money.

Scenario 3 — A bigger freeze lands (least likely, highest impact): Tether and major stablecoin issuers expand freezes, or a major bridge is compelled to halt a corridor. Tether already froze 378.7 million USDT. If issuers and exchanges coordinate on the Tron corridor itself — rather than individual addresses — a much larger share of the remaining funds could be stranded. This would require legal pressure and cross-company coordination that has not materialized so far, and it would set a precedent the decentralized world would fight.

The honest baseline: of the $6.3 billion stolen, roughly $3 billion has been frozen according to earlier reporting, about $242 million was laundered through Tron in two days, and the rest remains a race between automated laundering pipelines and an address-blocklist regime that does not yet cover the busiest road. The THORChain accident bought hours, not a solution.

What This Means for Your Crypto: A Quick Checklist

• Do not use a cross-chain bridge during a network incident — a reorg on one chain can freeze your swap on another with no warning.
• Never treat a protocol halt as a safety guarantee: THORChain's brake stopped everyone, including legitimate users, and recovered nothing.
• Assume stolen-fund flows resume the moment a halt lifts — laundering pipelines here run automatically, on hourly schedules, with fresh wallets.
• Watch Tether freeze announcements and FBI address-list updates, not headlines about "freezes" — only custody freezes hold assets, and only returns recover them.
• Keep exchange balances minimal after a major hack: Binance has reopened withdrawals in phases, and moving funds to self-custody removes exchange-counterparty risk entirely.

Frequently Asked Questions

What is THORChain? THORChain is a decentralized cross-chain exchange protocol that lets users swap crypto assets across different blockchains — for example, Bitcoin for Ethereum — without a centralized exchange. It runs on its own network of nodes and supports 13 connected chains.

What caused the THORChain halt on October 31, 2026? An Ethereum chain reorganization caused THORChain to refund the same 10 ETH deposit twice. The duplicate payment triggered the protocol's emergency pause, which halted swaps on 12 of its 13 chains.

Did THORChain freeze the Binance hackers' funds? No. The pause delayed laundering by stopping new swaps on most chains, but it did not seize or freeze any stolen assets. Funds that had already moved through THORChain — about $44 million via that route — were not recovered.

How much of the Binance loot has been laundered? Analyst SomaXBT reported about $242 million laundered via Tron in two days, out of roughly $628 million taken from Binance on Tron. Tether froze 378.7 million USDT, leaving about $249 million still to move on that corridor. Overall, roughly $3 billion of the $6.3 billion theft has reportedly been frozen.

Can THORChain block individual hacker transactions? No. The protocol can pause a chain or the whole network, but it has no mechanism to block or remove a single swap. Its co-founder has said node operators have no information beyond what is already public.

Is my crypto safe on THORChain during a halt? A halt stops swaps; it does not make funds disappear, and outbound signing stayed active on most chains during this incident. But halts can strand your swap for hours, and bridge risk — including reorg-related errors — is a real cost of cross-chain trading. Self-custody in a wallet you control avoids bridge and exchange counterparty risk.

Conclusion

The strangest detail of the biggest crypto hack on record may be its smallest number: 10 ETH. A duplicate refund of that size — an accounting glitch worth about $22,700 — did what sanctions lists, FBI warnings and a $387 million precedent could not: it stopped the laundering machine, briefly, on one of its busiest routes. The halt was accidental, partial and temporary, and it recovered nothing. But it exposed the real shape of the problem: the tools for stopping stolen crypto are either blunt (halt everything), incomplete (an address list with no Tron entries), or automated on the wrong side (hourly payouts that never sleep).

Watch what happens when swaps fully resume. If the Tron pipeline restarts at the same hourly pace, the pause will have bought investigators hours and headlines — and the hackers a minor inconvenience. If node operators or bridges start voluntarily blocking, the weekend's accident may turn into the first real friction the laundering operation has faced. Either way, the 10 ETH refund will stand as a reminder that in cross-chain crypto, the smallest bug can move the biggest story.

Sources: The Block, Crypto Briefing, TokenPost, Chainalysis via cited reporting, Elliptic, FBI October 31 alert, THORChain node data. Market context: Bitcoin near $78,000, Ethereum near $2,270, Crypto Fear & Greed Index at 34 (Fear) on November 1, 2026. This article is for information only and is not financial advice.