What exactly happened?
According to Incrypted, on October 31, 2026 a reorganization of a single block on Ethereum caused a mistaken payout of 10 ETH from the THORChain protocol's vault to one user. A block reorganization (block reorg) is a situation where the network temporarily replaces one confirmed block with another; transactions that appeared to be finished can thereby be overwritten.
According to Incrypted, the THORChain system automatically detected that funds were missing from the vault. Node operators responded by pausing operations. The user subsequently returned the assets, but according to Incrypted the team flagged the risk that the incident could recur, and it continues to work on eliminating the vulnerability.
Which networks are affected by the pause?
According to Cointelegraph, THORChain node operators paused swaps involving assets across ten networks. Among those named are Bitcoin, Ethereum, Solana, and Tron. The sources do not specifically list all ten chains.
THORChain is a cross-chain protocol, meaning infrastructure that allows native assets to be swapped across different blockchains without a central exchange. When operations are paused, it affects all users of those swaps, not just a single address.
How does this incident relate to the Binance and FBI case?
Here it is necessary to separate two things that overlap in time.
The first is the technical bug following the block reorganization, described above.
The second is pressure from law enforcement. According to The Defiant, in its call the FBI explicitly named THORChain node operators (THORNode operators). The Defiant states that the protocol's control mechanisms allow for a broad trading halt, which however simultaneously interrupts the operations of other users as well. According to The Defiant, THORChain's co-founder responded by pointing to publicly available data.
According to The Block, North Korean hackers are laundering part of the stolen funds from Binance, and the FBI is pressuring THORChain in this connection. The Block, citing an analyst, states that the crypto bridges Relay, THORChain, Chainflip, and Symbiosis moved roughly 140 million dollars of stolen funds from Tron, with Relay processing the most (about 48 million dollars). In total, according to The Block, North Korean hackers are said to have laundered approximately 242 million dollars from the Binance haul through Tron.
Cointelegraph connects these two threads in its headline: the technical pause following the reorg bug, in its view, incidentally also slowed down hackers linked to Binance.
What is proven and what is not yet
That the pause occurred and that it was caused by a mistaken payout of 10 ETH following a block reorganization is described by Incrypted. That the pause affects ten networks including Bitcoin, Ethereum, Solana, and Tron is reported by Cointelegraph. That the FBI named the node operators is described by The Defiant. The money-laundering figures come from an analyst cited by The Block.
What the sources do not yet confirm: whether the technical vulnerability has already been fully resolved, exactly when operations were restored across all networks, and whether and how the technical pause and the FBI pressure are directly connected (that is, whether it was a coincidence or a convergence). It is honest to label these points as unknown.
What to watch for in similar cases
With incidents involving cross-chain protocols, it pays to watch three things: the protocol's own official announcement about restoring operations, whether the team publishes a post-mortem describing the fix for the vulnerability, and on-chain data confirming the movement (or return) of funds. Until these three points are published, it is reasonable to treat partial information as an unfinished story.
Charliedesk is following this case and will update it as soon as verifiable information about the restoration of operations and the fix for the bug appears.