THORChain halts swaps after Ethereum reorg bug, slowing Binance hackers as outflows hit $5.8B

2 Nov 2026

2 Nov 2026, 06:07 UTC+01:00

DeFi TradeReviewed News Desk

THORChain halted swaps across most of its connected blockchains on Saturday after an Ethereum block reorganization exposed a refund bug, and the pause may have slowed the laundering of funds stolen from Binance, Cointelegraph reported, citing Chainalysis.

How the reorg bug worked

According to THORChain, the incident began at 11:34 UTC on Saturday, Oct. 31. A one-block reorg on Ethereum removed a 10 ETH deposit that THORChain had already credited. When the swap failed its price limit, THORChain refunded funds the vault never received, and also refunded the sender’s actual deposit, paying out an extra 10 ETH. That triggered an automatic pause.

The team warned the flaw is now public: “every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.” Node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP. “Nodes will decide to re-enable chains as they are deemed safe,” THORChain said. No restart time has been given.

Chainalysis: laundering delayed

“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis said on Sunday. Until the service is back, “neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.” The FBI had urged THORChain node operators and other providers on Saturday to block addresses tied to North Korea’s TraderTraitor group. Founder John-Paul Thorbjornsen has defended the protocol as permissionless and opposed taking it offline under pressure. We tracked earlier routes through Tron, Relay and THORChain in our Binance hack laundering report.

Binance outflows keep climbing

Separately, DefiLlama data showed $5.8 billion in Binance net outflows over 24 hours, Cointelegraph reported, above the roughly $3.6 billion Binance itself reported for the first hours after reopening withdrawals (our report). CNBC said Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits between 6:00 and 15:30 UTC on Nov. 1, about 2.1% of its $171 billion in assets. Changpeng Zhao wrote on X that “98% choose to stay!”

CryptoSlate, using DefiLlama, counted $2.51 billion in net outflows from tracked Binance wallets on Nov. 1: about $1.08 billion USDT, $912 million BTC, $385 million USDC and $131 million wrapped ETH. It cautioned that Binance now processes withdrawals through newly generated wallets, so on-chain figures are not a clean measure of customer exits. Binance says it has replenished about 95% of affected assets.

What it means for traders

• Cross-chain swaps: THORChain users on paused networks cannot swap until nodes re-enable chains.
• Figures differ by method: treat any single outflow number with caution.
• Spread risk: compare security and proof of reserves in our exchange comparison, with BingX and OKX as top picks.

This is not financial advice.

Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.

Related reviews

• Bingx review
• Okx review

Sources

• Cointelegraph: THORChain halts swaps after block reorg bug, slowing Binance hackers
• Cointelegraph: Binance net outflows surge to $5.8B as withdrawals resume after record hack
• CNBC: Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack
• CryptoSlate: Tracked Binance wallets record $2.5 billion in outflows as withdrawals reopen after hack

News is for information only and is not financial advice. More crypto news