THORChain’s Refund-o-Matic: Ethereum Reorg Triggers 10-Network Swap Freeze 🧊

THORChain halted swaps involving assets on 10 networks after an Ethereum block reorganization exposed a refund bug that caused the protocol to pay out 10 ETH it had never received. The incident began at 11:34 UTC on Saturday, when a one-block reorg removed a 10 ETH deposit that THORChain had already credited.

THORChain issued a refund when the swap failed to meet its price limit, even though the vault had never received the funds. The sender’s actual deposit was also refunded, creating an extra 10 ETH payout that triggered an automatic pause. “Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,” the protocol’s team said.

Node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP, according to THORChain’s network status page. “Nodes will decide to re-enable chains as they are deemed safe,” THORChain said.

The shutdown also disrupted attempts by North Korean hackers to launder funds stolen in last week’s $6.3 billion Binance hack, according to Chainalysis. “THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis said on Sunday, adding that the pause was “preventing all users, including DPRK’s money launderers, from using cross-chain swaps.” Until the service returns, “neither the hackers nor anyone else can swap through a majority of THORChain’s bridges,” Chainalysis said.

The incident came as US authorities pressed crypto infrastructure providers to restrict the movement of stolen funds. On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack. THORChain has continued to defend its role as neutral, permissionless infrastructure amid scrutiny over stolen funds moving through the protocol, and in its third-quarter report it maintained that position despite pressure to block transactions linked to hacked funds. Founder John-Paul Thorbjornsen separately defended the protocol’s “commitment to permissionless” infrastructure.