THORChain halts cross-chain swaps after Ethereum reorg exposes refund bug

THORChain suspended swaps across several major blockchains on Saturday after a block reorganization on Ethereum uncovered a vulnerability in the protocol’s refund logic. Blockchain analytics firm Chainalysis said the emergency shutdown may have also inadvertently delayed the movement of funds linked to a recent $6.3 billion Binance hack.

THORChain reacts to Ethereum block reorg bug

The pause began at 11:34 UTC, following an Ethereum reorganization that removed a 10 ETH deposit already credited by THORChain. When a swap attempt failed to execute at the expected price, THORChain’s system initiated a refund. However, since the associated deposit was erased by the reorg, the vault processed an extra 10 ETH as a refund, while still returning the original deposit to the sender. This sequence produced a duplicate payout and automatically triggered a suspension in the protocol.

An Ethereum block reorganization occurs when the network replaces a previously confirmed block with a different one, typically favoring a chain with more cumulative proof-of-work. This can result in legitimate transactions briefly appearing on-chain, then vanishing as the chain reorganizes. THORChain’s recently discovered bug allows refunds for deposits no longer recognized by Ethereum, creating an opening for exploitation.

THORChain’s team emphasized the potential risk, explaining that, with public awareness of this bug, a malicious actor could exploit block reorganizations on external networks by submitting new transactions with the same nonce and receiving funds from THORChain vaults.

Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.

In response, THORChain node operators halted swaps involving assets on 10 blockchains, including Bitcoin, Ethereum, Solana, and Tron. Swaps on Avalanche, Base, and XRP chains remained operational during the pause.

THORChain stated that nodes will independently decide when to re-enable support for affected networks once safety has been established.

Impact on laundering of Binance hacker funds

Chainalysis reported that the emergency pause disrupted efforts by North Korean hacking groups attempting to launder proceeds stolen in the Binance attack. The platform’s cross-chain capabilities have often been cited for facilitating the movement of assets across networks without traditional oversight or controls.

THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance, preventing all users, including DPRK’s money launderers, from using cross-chain swaps. Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.

Authorities in the United States have recently intensified pressure on DeFi protocols and infrastructure providers to implement controls that prevent the transfer of illicit proceeds. On Saturday, the FBI called on THORChain node operators, decentralized finance (DeFi) platforms, and virtual asset service providers to block transactions linked to addresses involved in laundering the Binance hack funds, many of which have been associated with the group known as TraderTraitor.

North Korean cyber actors have previously used THORChain to transfer assets between networks after successful crypto thefts, exploiting the protocol’s permissionless design.

Despite ongoing scrutiny, THORChain has consistently presented itself as a neutral, decentralized infrastructure provider. The project described its stance in the third-quarter report, insisting it would not deviate from its permissionless principles, even under pressure to restrict transactions identified as illicit.

John-Paul Thorbjornsen, the founder of THORChain, reiterated the protocol’s commitment to neutrality and permissionlessness, cautioning against suspending operations in response to external pressure.

IMO if THORNodes decided to take the protocol offline next week then the experiment is over. The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.

Mini dictionary: THORChain is a decentralized cross-chain liquidity protocol enabling users to swap assets directly across multiple blockchains without the need for centralized intermediaries. The protocol’s architecture is based on a network of node operators who manage cross-chain liquidity pools and facilitate secure settlements.