THORChain halted swaps on multiple blockchains on Saturday after an Ethereum block reorganization revealed a refund bug. The issue began at 11:34 UTC when a one‑block reorg removed a 10 ETH deposit that THORChain had already credited.
Because the swap failed to meet its price limit, THORChain issued a refund against funds the vault had never received. The sender’s original deposit was also refunded, resulting in an extra 10 ETH payout and triggering an automatic pause of swaps.
Technical cause
An Ethereum block reorganization replaces a recent block with a competing block. The discovered flaw allows THORChain to refund a payment that the Ethereum network no longer recognizes, creating a mismatch that could be exploited by a malicious actor.
Network impact
Node operators paused swaps involving assets on ten networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP. THORChain said nodes will re‑enable chains once they are deemed safe.
Effect on Binance hack investigation
Chainalysis reported that the emergency pause also delayed attempts by North Korean hackers to launder funds stolen in the recent $6.3 billion Binance hack. The pause prevented users, including the alleged launderers, from using THORChain’s cross‑chain bridges.
The FBI had earlier urged THORChain node operators and other virtual‑asset providers to block transactions linked to addresses used in the Binance hack.
Protocol stance
THORChain maintains its position as a neutral, permissionless infrastructure. In its third‑quarter report, the project reiterated its commitment to unencumbered settlement despite pressure to block illicit transactions. Founder John‑Paul Thorbjornsen warned that shutting down the protocol would end the experiment of neutral settlement.
