- Published on
THORChain halts swaps after block reorg bug, slowing Binance hackers
- Authors
- Name
- DeepHorus
THORChain halted cross-chain swaps on Saturday after an Ethereum block reorganization exposed a refund bug. The incident began at 11:34 UTC when a one-block reorg removed a 10 ETH deposit THORChain had already credited. A failed price limit triggered a refund for funds the vault never received, and the sender’s deposit was also refunded.
The extra 10 ETH payout automatically paused swaps, the protocol said. Node operators paused swaps for assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron. Trading continued on Avalanche, Base and XRP while nodes decide when chains are safe.
THORChain warned the flaw could be exploited now that it is public. A reorg replaces a recent block with a competing block, letting THORChain refund a payment Ethereum no longer recognizes. The team said an attacker could use the same nonce during future reorgs and be paid by THORChain vaults.
Chainalysis said the pause inadvertently slowed North Korean hackers laundering proceeds from last week’s $6.3 billion Binance hack. It said the halt prevented all users, including DPRK money launderers, from using cross-chain swaps. Until service returns, neither the hackers nor other users can swap through most THORChain bridges. The disruption came as US authorities pressed crypto providers to restrict stolen funds.
The FBI on Saturday urged THORChain node operators, DeFi services and other virtual asset providers to block transactions tied to TraderTraitor addresses used to launder Binance hack proceeds. THORChain has previously faced scrutiny over stolen funds moving through its protocol. It has defended its role as neutral, permissionless infrastructure.
Founder John-Paul Thorbjornsen warned that taking the protocol offline under pressure would end the experiment. THORChain said nodes will re-enable chains as they are deemed safe. The project has not announced a full reopening timeline.
