Key facts
- THORChain said a one-block Ethereum reorganization removed a 10 ETH deposit it had already credited, and a refund paid out an extra 10 ETH.
- THORChain said a malicious actor could replay a transaction with the same nonce after any external chain reorg and be paid by its vaults.
- THORChain said nodes will decide to re-enable chains as they are deemed safe.
- Chainalysis said the pause prevented all users, including North Korean launderers, from swapping through a majority of THORChain's bridges.
- THORChain founder John-Paul Thorbjornsen said taking the protocol offline would mean the experiment is over.
THORChain node operators halted swaps across multiple blockchains on Saturday after an Ethereum block reorganization exposed a refund bug, the protocol said. The incident began at 11:34 UTC when a one-block reorganization on Ethereum removed a 10 ETH deposit that THORChain had already credited. When the swap failed to meet its price limit, THORChain issued a refund against funds the vault had never received, and the sender's actual deposit was also refunded, producing an extra 10 ETH payout that triggered an automatic pause.
A block reorganization, or reorg, happens when a network replaces a recent block with a competing block. THORChain said the flaw lets it refund a payment that Ethereum no longer recognizes as having happened. The protocol's team said that now the issue is public, a malicious actor could perform a new transaction with the same nonce after any external chain reorg and be paid by THORChain vaults.
Node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP, according to the protocol's network status page. THORChain said nodes will decide to re-enable chains as they are deemed safe.
According to Chainalysis, the halt also disrupted attempts by North Korean hackers to launder funds stolen in last week's $6.3 billion Binance hack. The analytics firm said on Sunday that the pause inadvertently delayed the laundering of a significant amount of funds and prevented all users, including North Korean launderers, from using cross-chain swaps.
On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack. THORChain has used its role as neutral, permissionless infrastructure to defend against scrutiny of stolen funds moving through the protocol, and its founder John-Paul Thorbjornsen warned against shutting it down, saying that if THORNodes took the protocol offline the experiment would be over.