THORChain Halts Swaps After Ethereum Reorg Uncovers Refund Flaw, Slowing Movement of Stolen Binance Funds

The issue began at 11:34 UTC on Saturday when a single-block reorganization on Ethereum removed a previously credited 10 ETH deposit in THORChain. Since the swap did not meet its price limits, THORChain issued refunds for funds that the vault had not actually received. Furthermore, the original deposit was refunded to the sender, resulting in an excess 10 ETH payout and triggering an automatic pause of swaps.

A block reorganization (reorg) in Ethereum occurs when a newly added block is replaced by a competing block in the network. The discovered bug allows THORChain to refund a payment that Ethereum no longer recognizes as completed. This inconsistency could be exploited by attackers.

The protocol team explained, “Now that this information is public, whenever a block reorg happens on an external network, a malicious actor could submit a new transaction with the same nonce and receive payments from THORChain’s vaults.”

Following the discovery, THORChain node operators suspended swaps involving assets on ten networks—including Bitcoin, Ethereum, Solana, and Tron—while trading remained active on Avalanche, Base, and XRP, according to the protocol’s network status page.

THORChain stated that node operators will decide when to restore services on affected chains after ensuring their safety.

The emergency halt also interfered with North Korean hackers' ongoing efforts to launder funds stolen from Binance in a $6.3 billion hack last week, as reported by Chainalysis.

Chainalysis remarked on Sunday, “THORChain has unintentionally delayed laundering of a significant portion of funds stolen from Binance. The emergency pause is preventing all users—including DPRK money launderers—from using cross-chain swaps.”

They added, “Until THORChain resumes its services, neither hackers nor other users can perform swaps through most of its bridges.”

This incident occurred amid increasing pressure from US authorities on crypto infrastructure providers to impede the movement of stolen crypto assets.

On Saturday, the FBI urged THORChain node operators, DeFi platforms, and other virtual asset providers to block transactions connected to addresses used by TraderTraitor to launder proceeds from the Binance hack.

North Korean hackers have previously exploited THORChain to conduct private cryptocurrency swaps following earlier attacks.

Despite scrutiny over stolen assets passing through the protocol, THORChain continues to assert its role as a neutral and permissionless infrastructure.

In its third-quarter report, THORChain reaffirmed its commitment to neutrality and permissionlessness, resisting demands to block transactions involving stolen funds.

Founder John-Paul Thorbjornsen defended the protocol's permissionless approach, cautioning against shutting down THORChain due to pressure regarding illicit transactions.

He stated, “If THORNodes decide to take the protocol offline next week, in my opinion, the experiment will be over. The last stronghold of unrestrained and neutral settlement will have vanished, leaving no other platform, and the protocol would fail.”],

why

This event highlights the delicate balance between maintaining a permissionless cross-chain protocol and addressing risks related to stolen funds, illustrating how technical vulnerabilities can impact both security measures and laundering activities.

}