THORChain halts swaps after block reorg bug, slowing Binance hackers
-
Written by
Simonas Brazionis - Updated 2026-11-04 13:22:08
THORChain temporarily halted swaps across multiple blockchains on Saturday after a block reorganization on Ethereum exposed a refund bug, leading to a situation where THORChain halts swaps after block reorgs. This incident inadvertently hindered the movement of funds stolen from Binance, according to blockchain analytics firm Chainalysis.
The issue began when a one-block reorganization on Ethereum removed a 10 ETH deposit that THORChain had already processed. A refund was issued for funds the vault had not yet received, and the sender's original deposit was also refunded, resulting in an additional 10 ETH payout and triggering an automatic pause of the protocol.
Technical Vulnerability and Protocol Pause
An Ethereum block reorganization occurs when the network replaces a recent block with an alternative. The newly identified flaw permits THORChain to refund a payment that Ethereum no longer recognizes as having occurred, creating a potential exploit for malicious actors.
The protocol's team stated that with this vulnerability now public, any future block reorganization on an external chain could allow a malicious actor to perform a new transaction with the same nonce and receive funds from THORChain vaults.
THORChain node operators subsequently paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana, and Tron. Trading continued on Avalanche, Base, and XRP, as indicated on the protocol's network status page. THORChain communicated that nodes would re-enable chains once they were deemed secure.
Impact on North Korean Hackers and THORChain's Stance
This trading halt also disrupted attempts by North Korean hackers to launder funds stolen in a recent $6.3 billion Binance hack. Chainalysis noted that the emergency pause prevented all users, including those involved in money laundering, from utilizing cross-chain swaps through a majority of THORChain's bridges. This disruption occurred as US authorities urged crypto infrastructure providers to restrict the movement of stolen funds.
North Korean hackers have previously used THORChain for permissionless cryptocurrency swaps following attacks. However, THORChain has consistently maintained its position as neutral, permissionless infrastructure, even amid scrutiny over the movement of stolen funds through its protocol.
In its third-quarter report, the project affirmed this stance despite pressure to block transactions linked to hacked funds. THORChain founder John-Paul Thorbjornsen separately defended the protocol's commitment to permissionless transactions, cautioning against shutting it down in response to pressure concerning illicit funds, stating that such an action would signify the end of the experiment for unencumbered and neutral settlement.
