THORChain’s reported swap pause followed an October 31, 2026, Ethereum reorganization that exposed an error in a refund sequence involving 10 ETH. Separately, a November 8 report attributed estimates of more than $46 million in Binance-linked funds processed through THORChain to Chainalysis.

For the breach sequence, NeoTeo’s earlier Binance hack timeline traces how attackers reportedly reached wallet signing. This follow-up looks at reported cross-chain fund movements and the technical incident at THORChain.

Why THORChain paused swaps

A blockchain reorganization changes which blocks count as part of the accepted transaction history. In the October 31 incident, CryptoNews.net reported that Ethereum’s reorganization removed a 10 ETH deposit from the canonical chain after THORChain had credited it.

A swap then failed because its price limit was not met. According to the account, a THORChain vault issued a refund even though it had not received the deposit on Ethereum’s canonical chain, and the sender also got the original deposit back. The user later returned 10 ETH to restore the vault’s solvency.

CryptoNews.net said an automated solvency checker halted Ethereum swaps. Node operators then voted to stop transaction signing, roughly two minutes later. Cointelegraph, in reporting carried by TradingView, said the pause affected users broadly, including the alleged launderers.

What the reported Binance-linked flow figures count

A November 8 LiveMint article credited to The Wall Street Journal attributed estimates to Chainalysis of more than $46 million in Binance-linked funds processed through THORChain within 72 hours of the theft, with more than $200,000 in associated fees. The same report put funds mixed through Wasabi Wallet at nearly $4 million over that period.

Those figures describe different measures: funds processed, fees associated with THORChain transactions, and funds mixed through Wasabi Wallet. Readers interested in wider coverage of finance and digital assets can also explore NTV88.

A transaction total, a fee estimate and a mixing estimate describe different things; keep them separate.

The reported SOL route and swap resumption

DiarioBitcoin, citing Lookonchain, described a route from SOL to USDC, then to ETH on Ethereum, and finally to BTC through THORChain. The same outlet, citing Arkham, reported 182,443 SOL, valued at $16.9 million, in wallets attributed to the attackers, compared with 970,522 SOL said to have been stolen.

On November 4, DiarioBitcoin reported that swaps had resumed for Bitcoin, Ethereum and several other chains.