Swaps across 10 distinct networks—including heavyweights like Bitcoin, Ethereum, Solana, and Tron—were put on hold by THORChain node operators.
Swaps spanning several blockchains were frozen by THORChain on Saturday when an Ethereum block reorganization revealed a refund vulnerability, potentially stalling the transfer of assets looted from Binance, per Chainalysis findings.
According to THORChain, the ordeal kicked off Saturday at 11:34 UTC after a single-block reorganization on Ethereum wiped out a 10 ETH transfer that the network had already credited. Once the transaction breached its price limit, a refund was issued by THORChain for coins the vault never held. The user’s original deposit got returned as well, creating a duplicate 10 ETH payout that promptly sparked an emergency shutdown.
An Ethereum block reorganization, or reorg, occurs whenever a recent block gets replaced by a competing chain segment. Through this newly spotted flaw, refunds can be processed by THORChain for transfers Ethereum no longer considers valid—a gap that a bad actor could easily exploit.
“Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,”
the protocol’s team said.
Swaps involving tokens across 10 blockchains—such as Bitcoin, Ethereum, Solana, and Tron—were halted by THORChain node operators, though activity stayed live on Avalanche, Base, and XRP, based on the protocol’s status page.
“Nodes will decide to re-enable chains as they are deemed safe,”
said THORChain.
Emergency Pause Delays Binance Hackers’ Fund Transfers
Efforts by North Korean cybercriminals to launder capital taken during last week’s $6.3 billion Binance exploit were disrupted by the trading pause, according to Chainalysis.
“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” said Chainalysis on Sunday, explaining the emergency pause is “preventing all users, including DPRK’s money launderers, from using cross-chain swaps.”
“Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges,” said Chainalysis.
The freeze unfolded right as crypto infrastructure operators were pressed by US regulators to curb the transfer of illicit funds.
On Saturday, THORChain node operators, DeFi platforms, and rival crypto service providers were urged by the FBI to freeze activity linked to TraderTraitor wallets attempting to wash funds from the Binance breach.
THORChain has frequently been used by North Korean cybercriminals to permissionlessly swap digital assets after prior exploits.
Even so, its standing as neutral, permissionless architecture has been defended by THORChain despite intense scrutiny surrounding stolen capital flowing through the protocol.
Within its third-quarter report, that stance was reaffirmed by the project despite mounting pressure to censor transactions connected to stolen funds.
THORChain founder John-Paul Thorbjornsen separately defended the protocol’s commitment to permissionless transactions, warning that shutting it down over illicit fund pressure would be a mistake.
“IMO if THORNodes decided to take the protocol offline next week then the experiment is over,”
he said.
“The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”
