THORChain’s 10 ETH refund error disrupts Binance hackers’ transfers

cryptonews11-02

THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2680677730?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-11-02 17:30","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2680677730","market":"sh","top_or_hot":-1,"title":"THORChain’s 10 ETH refund error disrupts Binance hackers’ transfers","media":"cryptonews","content":"<div>\n<p>THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 ...</p>\n\n<a href=\"https://crypto.news/thorchain-halts-swaps-ethereum-reorg-binance-hackers/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>THORChain’s 10 ETH refund error disrupts Binance hackers’ transfers</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nTHORChain’s 10 ETH refund error disrupts Binance hackers’ transfers\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-11-02 17:30 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/thorchain-halts-swaps-ethereum-reorg-binance-hackers/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 ...</p>\n\n<a href=\"https://crypto.news/thorchain-halts-swaps-ethereum-reorg-binance-hackers/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"STCE","symbol_name":"Schwab Crypto Thematic ETF","start_time":0,"source_url":"https://crypto.news/thorchain-halts-swaps-ethereum-reorg-binance-hackers/","article_id":"2680677730","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/thorchain-halts-swaps-ethereum-reorg-binance-hackers/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2680677730","pubTimestamp":1793611807,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 billion Binance hack.THORChain suspended swaps on 10 blockchain networks after an Ethereum block reorganization caused an incorrect 10 ETH refund.The protocol’s automatic solvency checker detected the missing funds and halted Ethereum swaps before node operators paused additional chains.THORChain said the recipient returned the extra 10 ETH, restoring the affected vault’s balance.The FBI has urged THORChain operators and other crypto services to block transactions connected to North Korea’s TraderTraitor group.According to a November 2 statement, the cross-chain protocol encountered a refund problem following an Ethereum block reorganization on October 31. Its security systems detected a missing 10 ETH payment and halted Ethereum swaps before node operators suspended trading on other networks.","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"STCE":"Schwab Crypto Thematic ETF","ETHU":"2倍以太币期货ETF-Volatility Shares","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","HECO":"SPDR Galaxy Hedged Digital Asset Ecosystem ETF","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","09009":"博时以太币-U","BETH":"比特币&以太币期货ETF-ProShares","ETHV":"以太坊ETF-VanEck","ETU":"T-Rex 2X Long Ether Daily Target ETF","BTF":"比特币&以太币期货ETF-CoinShares","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","ETH":"低成本以太坊ETF-Grayscale","ETHW":"以太坊ETF-Bitwise","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF","QETH":"以太坊ETF-Invesco Galaxy","ETHA":"以太坊ETF-iShares","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","AETH":"以太坊策略ETF-Bitwise","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","CETH":"以太坊ETF-21Shares","EETH":"以太币期货ETF-ProShares","FETH":"以太币ETF-Fidelity","03179":"嘉实以太币","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","BITQ":"Bitwise Crypto Industry Innovators ETF","BTC":"Grayscale Bitcoin Mini Trust","ETHD":"ProShares UltraShort Ether ETF","09179":"嘉实以太币-U","GDLC":"Grayscale CoinDesk Crypto 5 ETF","EZET":"以太坊ETF-Franklin","ETHE":"最大以太坊ETF-Grayscale","BPI":"Grayscale Bitcoin Premium Income ETF","ETHI":"Defiance Leveraged Long Income Ethereum ETF","BKCH":"AdvisorShares Sabretooth ETF","ARKY":"ARK Active Autocallable Income ETF","ETCO":"Grayscale Ethereum HIGH Income ETF","BITW":"Bitwise 10 Crypto Index ETF","BETE":"等权重比特币&以太币期货ETF-ProShares","09046":"华夏以太币-U","03046":"华夏以太币","SETH":"1倍做空以太币期货ETF-Proshares","03009":"博时以太币","ETTY":"Amplify Ethereum 3% Monthly Option Income Etf","ETHT":"ProShares Ultra Ether ETF","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","YETH":"Roundhill Ether Covered Call Strategy ETF","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October"},"translate_title":"THORChain 的 10 ETH 退款错误扰乱了币安黑客的转账","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"EZET":1.5,"CETH":0.9,"ETHT":1.5,"BEGS":1.5,"ETHI":0.6,"ETTY":1.5,"BTCZ":0.6,"AETH":1.5,"ETHA":1.5,"BITQ":0.9,"BKCH":0.9,"BTC":0.6,"ETHW":1.5,"03009":0.9,"03179":0.9,"STCE":1.5,"YETH":1.5,"HECO":0.86,"EETH":1.5,"ARKY":1.5,"ETQ":0.6,"XBTY":0.6,"09046":0.9,"ETCO":0.6,"09009":0.9,"BITW":0.9,"CBOO":0.6,"FETH":1.5,"BETE":1.5,"LFGY":0.9,"03046":0.9,"BETH":1.5,"ETHV":1.5,"SETH":0.6,"ETHU":1.5,"ETHD":1.5,"CRPT":1.5,"ETH":1.5,"09179":0.9,"CBTO":0.6,"ETHE":1.5,"ETU":1.5,"BPI":0.6,"QETH":1.5,"METHmain":1.5,"BTF":1.5,"GDLC":0.9,"NCIQ":1.5},"content_text":"THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 billion Binance hack.\n\n\nSummary\n\n\n\nTHORChain suspended swaps on 10 blockchain networks after an Ethereum block reorganization caused an incorrect 10 ETH refund.\nThe protocol’s automatic solvency checker detected the missing funds and halted Ethereum swaps before node operators paused additional chains.\nTHORChain said the recipient returned the extra 10 ETH, restoring the affected vault’s balance.\nChainalysis reported that the interruption temporarily delayed cross-chain transfers linked to the $6.3 billion Binance hack.\nThe FBI has urged THORChain operators and other crypto services to block transactions connected to North Korea’s TraderTraitor group.\n\n\n\nAccording to a November 2 statement, the cross-chain protocol encountered a refund problem following an Ethereum block reorganization on October 31. Its security systems detected a missing 10 ETH payment and halted Ethereum swaps before node operators suspended trading on other networks.\n\nOn October 31, THORChain halted trading on several blockchains.An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators…— THORChain (@THORChain) November 1, 2026\n\nBlockchain analytics firm Chainalysis said the interruption prevented users, including suspected North Korean money launderers, from accessing most of THORChain’s cross-chain services.\nTHORChain halts swaps after 10 ETH refund error\nThe incident began at 11:34 UTC on October 31, when Ethereum underwent a one-block reorganization that removed a recent transaction from its accepted blockchain history.\nThe affected transaction involved a 10 ETH deposit intended for a THORChain vault. Although Ethereum subsequently removed the deposit, THORChain had already recognized the incoming payment.\nThe associated swap failed to meet the sender’s specified price limit, prompting the protocol to issue a refund.\nHowever, because the original deposit was no longer recorded on Ethereum’s accepted chain, THORChain sent 10 ETH from a vault that had not received the corresponding funds.\nThe sender’s actual deposit was refunded separately, resulting in an additional 10 ETH payout.\nTHORChain said its automatic solvency checker detected the difference between recorded and available funds, immediately suspending Ethereum swaps.\nWithin roughly two minutes, node operators stopped outbound Ethereum transaction signing to prevent further withdrawals from the affected vaults.\nThe team subsequently paused other connected networks while developers examined the problem.\nAccording to the protocol, the recipient returned the extra 10 ETH, restoring the vault’s balance.\nBitcoin and Ethereum among 10 affected networks\nThe emergency response affected swaps involving Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash.\nTrading remained available on Avalanche, Base and XRP Ledger, alongside THORChain’s native network.\nThe protocol’s network dashboard provides the operational status of supported blockchains as node operators assess when services can resume.\nTHORChain explained that the problem arose because its systems initially accepted a deposit that Ethereum later removed during the block reorganization.\nAn Ethereum reorganization occurs when the network replaces a recent block with another version of its transaction history.\nIn this case, the discrepancy allowed THORChain’s refund process to recognize funds that were no longer present in the accepted Ethereum record.\nThe team warned that a similar issue could potentially occur following reorganizations on other supported blockchains.\nAccording to THORChain, an attacker could exploit the problem by submitting another transaction using the same nonce after an earlier deposit disappeared from the accepted chain.\nDevelopers are preparing changes intended to prevent the refund process from treating discarded transactions as completed deposits.\nThe protocol said node operators would determine when individual chains were safe to reopen.\nChainalysis says pause disrupted Binance hackers\nThe trading interruption occurred as blockchain investigators continued tracing funds stolen from Binance during the October 29 security breach.\nChainalysis said the technical failure had inadvertently delayed the movement of assets linked to the attack.\nThe company explained that the emergency pause stopped ordinary users and suspected money launderers from accessing most of THORChain’s cross-chain swapping routes.\nEarlier, the FBI attributed the Binance attack to North Korea’s state-sponsored TraderTraitor group.\nIn its October 31 notice, the agency said the attackers had been converting stolen cryptocurrency primarily into Ethereum before attempting further transfers through decentralized finance and instant-swap services.\nThe FBI urged THORChain node operators, exchanges, blockchain infrastructure providers and other virtual asset businesses to block transactions involving identified attacker addresses.\nThe agency published a list of cryptocurrency wallets associated with the stolen funds to help service providers identify suspicious transfers.\nHowever, THORChain’s October 31 shutdown resulted from its own technical safeguards, not a decision to selectively block the Binance attackers.\nTHORChain has faced earlier disputes over stolen funds\nThe latest interruption follows previous disagreements over whether THORChain should restrict transactions involving stolen cryptocurrency.\nIn September, Bitget asked the protocol to block identified hacker addresses following a $387.5 million security breach.\nTHORChain rejected the request, arguing that its emergency shutdown mechanisms were intended to protect network operations, not freeze individual transactions.\nSecurity firm GoPlus subsequently questioned the protocol’s decentralization, pointing to the ability of validators to pause trading and control outbound signing during emergencies.\nEarlier in October, independent researcher Andrey Sergeenkov traced fees generated through transactions involving assets stolen from Bitget.\nHis analysis found that THORChain liquidity providers received $573,226 in fees from the reviewed transactions, while additional affiliate payments reached addresses with varying degrees of connection to the stolen-fund movements.\nTHORChain experienced a separate security incident in May when a compromised vault lost approximately $10.7 million.\nFollowing that attack, the protocol introduced security changes and an 11-step restart plan before restoring trading in June.\nFounder John-Paul Thorbjornsen defended the network’s permissionless design, warning that permanently shutting down THORChain over demands to block illicit transactions would undermine its operating principles.\n\n\n\n\n\n                Read more:\n            \n\n                ICE wants Hyperliquid-based markets in the US. What changes?","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.1","shortVersion":"4.52.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2680677730","isCrawlerRequest":true}