THORChain pauses swaps after Ethereum reorg exposes refund bug

THORChain halted swaps on 10 blockchain networks Saturday after an Ethereum block reorganization exposed a refund bug and disrupted the movement of funds stolen in the $6.3 billion Binance hack. Chainalysis said the pause delayed suspected North Korean hackers’ attempts to move the assets through cross-chain swaps.

The incident began at 11:34 UTC when Ethereum replaced a recent block with a competing block. The change removed a 10 ETH deposit that THORChain had already credited to a user.

The swap later failed to meet its price limit. THORChain then issued a refund even though its vault had not received the funds. The original deposit was refunded as well, creating an additional 10 ETH payout. That payout triggered THORChain’s automatic safety pause.

The flaw allows the protocol to refund a transaction that Ethereum no longer recognizes as completed. A malicious actor could exploit the mismatch by submitting a new transaction with the same nonce after a reorganization on an external blockchain, potentially receiving funds from THORChain’s vaults.

Node operators paused swaps involving assets on Bitcoin, Ethereum, Solana, Tron and six other networks. Trading continued on Avalanche, Base and XRP, according to THORChain’s network status page. “Nodes will decide to re-enable chains as they are deemed safe,” the protocol said.

Chainalysis said the pause prevented users from accessing most of THORChain’s cross-chain bridges, including people attempting to launder funds stolen from Binance. “THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” the blockchain analytics firm said Sunday.

The disruption followed an FBI request Saturday for THORChain node operators, decentralized finance services and other virtual asset providers to block transactions linked to addresses that investigators said TraderTraitor was using to launder proceeds from the Binance hack.

North Korean hackers have previously used THORChain to swap cryptocurrencies without approval from a central operator. THORChain has defended its policy of processing transactions without screening users or freezing funds based solely on their source.

In its third-quarter report, THORChain said it maintained that position despite pressure to block assets connected to hacks. Founder John-Paul Thorbjornsen warned that taking the protocol offline in response to such pressure would end its role as a neutral settlement system. “If THORNodes decided to take the protocol offline next week then the experiment is over,” he wrote. “The last bastion of unencumbered and neutral settlement is over.”