Binance hackers hit a THORChain speed bump as a 10 ETH refund glitch joined the chase

THORChain halted swaps across multiple blockchains on Saturday after an Ethereum block reorganization exposed a refund bug that inadvertently delayed the movement of funds stolen from Binance, according to Chainalysis. The incident began at 11:34 UTC on Saturday when a one-block reorganization on Ethereum removed a 10 ETH deposit that THORChain had already credited. When the swap failed to meet its price limit, THORChain issued a refund against funds the vault had never received. The sender’s actual deposit was also refunded, producing an extra 10 ETH payout and triggering an automatic pause.

THORChain said the newly discovered flaw allowed it to refund a payment that Ethereum no longer recognized as having happened. “Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,” the protocol’s team said. Node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP. “Nodes will decide to re-enable chains as they are deemed safe,” THORChain said.

The attackers behind the $6.3 billion Binance hack have moved about 81% of the stolen Solana as they launder assets through THORChain. Wallets grouped under the Binance hacker entity held 182,443 SOL, worth $16.9 million and roughly 18.8% of the total 970,522 SOL stolen during the exploit, according to blockchain data platform Arkham. Lookonchain reported on Wednesday that the attackers split SOL across multiple wallets, selling it for USDC, bridging to Ethereum to buy Ether, and ultimately swapping ETH for Bitcoin ($BTC) via THORChain. THORChain restored trading on Bitcoin, Ethereum and several other chains on Wednesday.

Chainalysis said the emergency pause prevented all users, including DPRK’s money launderers, from using cross-chain swaps. “THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis said on Sunday. “Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.” Blockchain investigator SomaXBT estimated that about 54% of the attackers’ more than 47,600 transactions on Tron and Solana were automated. Chainalysis estimated that about $500 million in total value moved through Tron, including repeated transfers between wallets.

Binance suffered a record-setting hack on Thursday after attackers compromised employee devices through fake job interviews and malicious software downloads, the exchange said. On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack. The bureau attributed the attack to North Korea’s TraderTraitor hackers. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as “absurd rhetoric.” Binance said Tuesday it had replenished 98% of affected tokens and would absorb losses. THORChain has maintained its position as neutral, permissionless infrastructure, stating in its third-quarter report that it continued to do so despite pressure to block transactions linked to hacked funds.