THORChain halted swaps across ten blockchain networks on Saturday after an Ethereum block reorganization exposed a refund bug, inadvertently disrupting efforts by North Korean hackers to launder funds stolen in last week's $6.3 billion Binance hack, according to blockchain analytics firm Chainalysis.
According to THORChain, the incident began at 11:34 UTC on Saturday when a one-block reorganization on Ethereum removed a 10 ETH deposit that THORChain had already credited. After the swap failed to meet its price limit, the protocol issued a refund against funds it had not received, leading to an extra 10 ETH payout and triggering an automatic pause. Swaps involving Bitcoin, Ethereum, Solana and Tron were suspended, while trading continued on Avalanche, Base and XRP.
An Ethereum block reorganization, or reorg, occurs when the network replaces a recent block with a competing block. The newly discovered flaw allows THORChain to refund a payment that Ethereum no longer recognizes as having happened. THORChain warned that with the bug public knowledge, every time a block reorg happens on an external chain, a malicious actor could perform a new transaction with the same nonce and be paid funds by the THORChain vaults.
Chainalysis said the emergency pause was "preventing all users, including DPRK's money launderers, from using cross-chain swaps" and that "until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain's bridges." The FBI on Saturday urged THORChain node operators, DeFi services and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack.
THORChain has defended its role as neutral, permissionless infrastructure amid scrutiny over stolen funds moving through the protocol. Founder John-Paul Thorbjornsen warned that taking the protocol offline would end an experiment in unencumbered settlement: "IMO if THORNodes decided to take the protocol offline next week then the experiment is over. The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed."
Analysis
Why This Matters
- The bug exposes a cross-chain swap vulnerability that could be exploited in future block reorganizations.
- The pause directly affects the movement of billions of dollars from the Binance hack, giving authorities time to track funds.
- Highlights the tension between permissionless DeFi and regulatory pressure on illicit finance.
Background
THORChain is a decentralized protocol that allows users to swap assets across different blockchains without intermediaries. A block reorg occurs when the network replaces a recent block, potentially changing transaction records. The bug lets THORChain refund transactions that the source chain no longer recognizes. Last week's $6.3 billion Binance hack, attributed to North Korean hackers (whom the FBI has labeled TraderTraitor), has seen stolen funds moved through THORChain in previous incidents.
Key Perspectives
- THORChain: Describes itself as neutral, permissionless infrastructure and warns that shutting it down would end an experiment in unencumbered settlement.
- Chainalysis: Says the pause inadvertently delayed the laundering of stolen Binance funds, preventing hackers from using cross-chain swaps.
- FBI: Urged node operators and DeFi services to block transactions linked to the hackers' addresses.
What to Watch
- THORChain node operators will decide when to re-enable each chain based on safety assessments.
- US authorities may intensify pressure on DeFi infrastructure providers to restrict illicit fund flows.
- The protocol's community must decide how to patch the bug without compromising its permissionless model.
Checked
10 claims in this story checked against 1 source: 8 supported.
Show each claim
- SupportedTHORChain paused swaps after an Ethereum reorg exposed a refund flaw, possibly slowing the Binance hackers.Cointelegraph.com News: “THORChain halted swaps across multiple blockchains on Saturday after an Ethereum block reorganization exposed a refund bug, which may have inadvertently slowed the movement of funds stolen from Binance, according to Chainalysis.”
- SupportedThe halt delayed North Korean hackers’ laundering of funds from last week’s $6.3 billion Binance hack, according to Chainalysis.Cointelegraph.com News: “The trading halt also disrupted attempts by North Korean hackers to launder funds stolen in last week’s $6.3 billion Binance hack, according to Chainalysis.”
- Partly supportedThe FBI urged providers to block addresses used by TraderTraitor.Cointelegraph.com News: “On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack.”
- Partly supportedA one-block Ethereum reorg removed a credited 10 ETH deposit; after the swap missed its price limit, the refund caused an extra 10 ETH payout and an automatic pause.Cointelegraph.com News: “When the swap failed to meet its price limit, THORChain issued a refund against funds the vault had never received. The sender’s actual deposit was also refunded, resulting in an extra 10 ETH payout, which then triggered an automatic pause.”
- SupportedSwaps involving assets on ten networks, including Bitcoin, Ethereum, Solana and Tron, were paused, while trading continued on Avalanche, Base and XRP.Cointelegraph.com News: “THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP, according to the protocol’s network status page.”
- SupportedChainalysis said the pause was “preventing all users, including DPRK's money launderers, from using cross-chain swaps.”Cointelegraph.com News: ““THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” said Chainalysis on Sunday, explaining the emergency pause is “preventing all users, including DPRK’s money launderers, from using cross-chain swaps.””
- SupportedChainalysis said that until the service returned, neither hackers nor anyone else could swap through a majority of THORChain’s bridges.Cointelegraph.com News: ““Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges,” said Chainalysis.”
- SupportedTHORChain warned that after an external-chain reorg, a malicious actor could make a new transaction with the same nonce and be paid by THORChain vaults.Cointelegraph.com News: ““Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,” the protocol’s team said.”
- SupportedFounder John-Paul Thorbjornsen said taking THORChain offline next week would end the experiment and the prospect of neutral settlement.Cointelegraph.com News: ““IMO if THORNodes decided to take the protocol offline next week then the experiment is over,” he said. “The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.””
- SupportedTHORChain has defended its role as neutral, permissionless infrastructure amid scrutiny over stolen funds moving through the protocol.Cointelegraph.com News: “However, THORChain has continued to defend its role as neutral, permissionless infrastructure amid scrutiny over stolen funds moving through the protocol.”
