THORChain Halts Cross-Chain Swaps After Reorg Bug Exposed 10 ETH Refund Flaw

THORChain node operators halted swaps across 10 networks on Saturday after a one-block Ethereum reorganization triggered an erroneous 10 ETH refund and exposed a vulnerability in the protocol's refund logic. The pause, which covers Bitcoin, Ethereum, Solana and Tron among other chains, has also — by accident — stalled attempts by North Korean hackers to launder funds from last week's $6.3 billion Binance hack, according to blockchain analytics firm Chainalysis.

The incident began at 11:34 UTC on Saturday. A reorg on Ethereum removed a 10 ETH deposit that THORChain had already credited. The swap then failed to meet its price limit, so THORChain issued a refund against funds the vault never actually received. The sender got their original deposit back too. The vault was out an extra 10 ETH, and an automatic pause kicked in.

A reorg happens when a blockchain replaces a recent block with a competing one. The bug lets THORChain refund a payment that Ethereum no longer recognizes as valid. That mismatch is exploitable, and the team didn't mince words about it.

"Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults," the protocol's team said.

Trading continued on Avalanche, Base and XRP, according to THORChain's network status page. "Nodes will decide to re-enable chains as they are deemed safe," the project said.

What does the outage mean for the Binance hack trail?

Plenty, according to Chainalysis. The firm said on Sunday that the halt is "preventing all users, including DPRK's money launderers, from using cross-chain swaps."

"THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance," Chainalysis said.

"Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain's bridges," the firm added.

The timing matters. US authorities have been leaning on crypto infrastructure providers to restrict the movement of stolen funds. On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions tied to addresses used by TraderTraitor — the North Korean-linked operation laundering proceeds from the Binance breach.

North Korean hackers have used THORChain to swap cryptocurrencies permissionlessly after previous attacks.

Can a neutral protocol survive this pressure?

THORChain has consistently defended its role as neutral, permissionless infrastructure, even as scrutiny over stolen funds moving through the protocol intensifies. Its third-quarter report reiterated that stance despite pressure to block transactions linked to hacked funds.

Founder John-Paul Thorbjornsen went further, warning against shutting the protocol down in response to pressure over illicit funds.

"IMO if THORNodes decided to take the protocol offline next week then the experiment is over," he said. "The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed."

The irony is hard to miss. A bug forced the pause, not policy. Node operators, some of whom the FBI just addressed directly, now hold the keys to both the protocol's recovery and — temporarily — a bottleneck in one of the largest laundering pipelines in crypto history.

The operational stakes are straightforward: every external chain remains a refund-exploitation risk until node operators patch or mitigate the nonce-reuse vector and vote chains back online. For now, there's no published deadline for the re-enabling votes, meaning traders, liquidity providers and investigators alike are watching the network status page for each chain's return.