# THORChain network halt and resumption

> Developing situation record from CLSTR: https://clstr.news/situations/thorchain-network-halt-and-resumption
> Updated: 2026-11-04T17:42:05.000Z. Sources: 16. Developments: 2.

On October 31, a one-block reorganization on the Ethereum network caused a technical error on the THORChain protocol. A 10 ETH deposit disappeared from the canonical chain after THORChain had already credited it, leading to a double refund that left a protocol vault with a 10 ETH shortfall. In response to an automatic solvency check, node operators halted trading on several networks, including Bitcoin, Ethereum, Solana, and Tron.

By November 4, THORChain resumed swaps on 11 blockchains, including Bitcoin, Ethereum, and RUNE. However, swaps for Solana, BNB Chain, and Cosmos remained halted while operators completed a software update. During this period, reports indicated that North Korean hackers, identified by the FBI as the TraderTraitor group, resumed using the network to swap stolen ether for bitcoin following a major theft from Binance hot wallets.

## Timeline

### 2026-11-04: THORChain resumes swaps following network halt

THORChain has resumed swaps on 11 blockchains after a software bug caused a temporary halt. North Korean hackers are reportedly using the reopened network to launder stolen funds.

4 sources. https://clstr.news/cluster/thorchain-resumes-swaps-following-network-halt

### 2026-10-31: THORChain halts swaps after Ethereum reorg causes 10 ETH overpayment

An Ethereum block reorg caused THORChain to accidentally double-refund 10 ETH, triggering an emergency halt on most chains and inadvertently delaying laundering of stolen Binance hack funds.

14 sources. https://clstr.news/cluster/thorchain-pauses-operations-following-ethereum-reorganization

---
Cite as: THORChain network halt and resumption. CLSTR, https://clstr.news/situations/thorchain-network-halt-and-resumption