THORChain halts swaps after block reorg bug, slowing Binance hackers

THORChain paused swaps after an Ethereum block reorganization exposed a bug in its refund process. The halt mattered because THORChain connects assets across blockchains, so stopping swaps disrupted users and cross-chain fund movements. It also temporarily limited a route used by hackers moving stolen cryptocurrency.

The pause covered assets on 10 networks. Bitcoin, Ethereum, Solana and Tron were among the affected networks. Swaps continued on Avalanche, Base and XRP. The trigger was a removed 10 ETH deposit that THORChain had already credited, creating an incorrect refund and an extra 10 ETH payout.

Node operators were told to re-enable chains only when they were considered safe. Chainalysis said the halt also delayed attempts to launder funds stolen in the $6.3 billion Binance hack. The incident highlighted both the usefulness and risk of permissionless cross-chain infrastructure, especially when external blockchains reorganize their recent history.

THORChain node operators paused swaps involving assets on 10 networks. This was an emergency response to a bug involving Ethereum block reorganizations, rather than a complete shutdown of every THORChain function. The decision reduced the chance that similar discrepancies could produce incorrect payouts on connected chains.

The affected group included Bitcoin, Ethereum, Solana and Tron. The article does not list all 10 paused networks, but it identifies those four as examples. Trading continued on Avalanche, Base and XRP, which remained available while other chains were assessed.

THORChain said nodes would decide when individual chains were safe to re-enable. This chain-by-chain approach reflected the source of the problem: THORChain depends on events reported by external blockchains. The halt also prevented users, including suspected Binance-hack launderers, from using most of THORChain’s cross-chain bridges.

THORChain is a protocol for cross-chain swaps. It lets people exchange cryptocurrency from one blockchain for assets on another, without requiring every asset to exist on the same chain. The article describes it as neutral, permissionless infrastructure, meaning users can access its settlement system without a central operator approving each swap.

A user deposits one asset, and THORChain’s vaults help execute the corresponding swap and payout on another network. Bridges connect the different chains involved. In the incident, THORChain credited a 10 ETH deposit before Ethereum later removed that deposit through a one-block reorganization. The mismatch affected the vault’s refund logic.

This design makes cross-chain trading useful, but it also creates dependency on outside networks and their transaction histories. THORChain paused many routes after the flaw appeared. The pause showed how shared infrastructure can support ordinary users while also being used to move funds stolen in major hacks.

An Ethereum block reorganization, or reorg, occurs when the network replaces a recent block with a competing block. The replacement becomes part of the accepted chain history, while transactions included only in the discarded block may no longer count as confirmed deposits. This can temporarily change what the network recognizes as having happened.

In this case, a one-block reorganization removed a 10 ETH deposit. THORChain had already credited that deposit before Ethereum adopted the competing block. Ethereum therefore no longer recognized the payment in the accepted history, even though THORChain’s internal process had acted on it.

That difference created the security problem. THORChain’s system treated the deposit as real, while Ethereum’s revised history did not. The team warned that a malicious actor could exploit this mismatch by submitting another transaction with the same nonce after a reorganization. The incident led operators to pause swaps across many networks.

The problem began when Ethereum removed a 10 ETH deposit after THORChain had already credited it. When the swap failed to meet its price limit, THORChain’s logic attempted to refund the payment. But Ethereum’s revised history meant the vault had never actually received that deposit according to the accepted chain.

THORChain therefore issued a refund against funds the vault did not have. The sender’s actual deposit was also refunded. Together, those actions created an extra 10 ETH payout. The system effectively paid out twice because THORChain’s records and Ethereum’s final accepted history disagreed.

That abnormal payout triggered THORChain’s automatic pause. The safety response stopped many swaps while node operators assessed the affected chains. The team also warned that, now the flaw was public, attackers could repeat the pattern after external-chain reorganizations by using a new transaction with the same nonce.

The emergency pause disrupted attempts to move and launder cryptocurrency stolen in the Binance hack. Chainalysis said North Korean hackers had been using THORChain’s cross-chain routes and that the halt inadvertently delayed a significant amount of the stolen funds. The pause affected ordinary users and suspected launderers alike.

THORChain stopped swaps on assets across most of its bridges. Because those bridges connect different blockchain networks, disabling them removed important routes for converting or relocating the hackers’ cryptocurrency. Chainalysis said neither the hackers nor anyone else could swap through a majority of THORChain’s bridges while the service was offline.

The disruption came as US authorities urged crypto infrastructure providers to restrict stolen funds. The FBI asked THORChain node operators, DeFi services and other virtual asset providers to block transactions tied to addresses used by TraderTraitor. THORChain, however, continued defending its permissionless and neutral role.

Blockchain confirmations are successive blocks that strengthen confidence that a transaction belongs to the accepted chain history. A transaction nonce is a sender-specific sequence value that distinguishes transactions and normally prevents accidental replay. Permissionless protocols let users transact without prior approval, which is central to THORChain’s claim of neutral infrastructure.

The incident exposed how these ideas can collide. THORChain credited a 10 ETH deposit before an Ethereum reorganization removed it from the accepted history. The team warned that an attacker could submit a new transaction with the same nonce after a reorg and potentially receive funds from THORChain vaults. The system had acted before the external history was stable.

Open access helps users move assets without gatekeepers, but it can also leave services exposed to stolen funds. The FBI urged providers to block addresses linked to TraderTraitor. THORChain’s founder argued that shutting down permissionless settlement would end the protocol’s experiment in neutral infrastructure.