THORChain halts swaps after block reorg bug, slowing Binance hackers

THORChain halted swaps across multiple blockchains on Saturday after an Ethereum block reorganization exposed a refund bug, which may have inadvertently slowed the movement of funds stolen from Binance, according to Chainalysis.

According to THORChain, the incident began at 11:34 UTC on Saturday, when a one-block reorganization on Ethereum removed a 10 $ETH deposit that THORChain had already credited. When the swap failed to meet its price limit, THORChain issued a refund against funds the vault had never received. The sender’s actual deposit was also refunded, resulting in an extra 10 $ETH payout, which then triggered an automatic pause.

An Ethereum block reorganization, or reorg, happens when the network replaces a recent block with a competing block. The newly discovered flaw lets THORChain refund a payment that Ethereum no longer recognizes as having happened. A malicious actor could potentially exploit that mismatch.

“Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,” the protocol’s team said.

THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP, according to the protocol’s network status page.

“Nodes will decide to re-enable chains as they are deemed safe,” said THORChain.

Emergency pause delays Binance hackers’ fund movements

The trading halt also disrupted attempts by North Korean hackers to launder funds stolen in last week’s $6.3 billion Binance hack, according to Chainalysis.

“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” said Chainalysis on Sunday, explaining the emergency pause is “preventing all users, including DPRK’s money launderers, from using cross-chain swaps.”

“Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges,” said Chainalysis.

The disruption came as US authorities pressed crypto infrastructure providers to restrict the movement of stolen funds.

On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack.

North Korean hackers have used THORChain to permissionlessly swap cryptocurrencies following previous attacks.

However, THORChain has continued to defend its role as neutral, permissionless infrastructure amid scrutiny over stolen funds moving through the protocol.

In its third-quarter report, the project said it maintained that position despite pressure to block transactions linked to hacked funds.

THORChain founder John-Paul Thorbjornsen separately defended the protocol’s commitment to permissionless transactions, warning against shutting it down in response to pressure over illicit funds.

“IMO if THORNodes decided to take the protocol offline next week then the experiment is over,” he said.

“The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”