THORChain Halts Swaps After Reorg Bug Delays Binance Hackers

THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, after an Ethereum block reorganization exposed a refund vulnerability. The incident began at 11:34 UTC Saturday, when a one-block reorg removed a 10 ETH deposit that THORChain had already credited. When the swap failed to meet its price limit, the protocol issued a refund using funds the vault had never received. The sender’s deposit was also returned, producing an extra 10 ETH payout that triggered THORChain’s automatic pause.

The flaw creates a potential security risk because a payment removed by an Ethereum reorg could still be refunded by THORChain. According to the protocol’s team, a malicious actor could exploit the now-public issue by reusing the same nonce after another reorganization and extracting funds from THORChain vaults. Trading continued on Avalanche, Base and XRP, but node operators will decide independently when each paused chain is safe to reactivate.

Chainalysis said the emergency shutdown inadvertently delayed efforts by North Korean hackers to launder funds stolen in last week’s reported $6.3 billion Binance hack. Because THORChain’s cross-chain swaps were unavailable on most supported networks, the hackers—and other users—were unable to move the stolen assets through the protocol’s bridges while the security issue remained unresolved.

The disruption came as US authorities sought to restrict the movement of stolen funds. The FBI urged THORChain node operators, decentralized finance services and other virtual asset providers to block transactions tied to addresses used by TraderTraitor to launder proceeds from the Binance hack.