THORChain halts swaps after block reorg bug, slowing Binance hackers
THORChain halted swaps across 10 blockchains on Saturday after an Ethereum block reorganization exposed a refund bug that may have slowed Binance hackers.
The incident began at 11:34 UTC on Saturday when a one-block reorganization on Ethereum removed a 10 ETH deposit that THORChain had already credited. When the swap failed to meet its price limit, THORChain issued a refund against funds the vault had never received. The sender's actual deposit was also refunded, resulting in an extra 10 ETH payout, which then triggered an automatic pause.
An Ethereum block reorganization happens when the network replaces a recent block with a competing block. The newly discovered flaw lets THORChain refund a payment that Ethereum no longer recognizes as having happened. A malicious actor could potentially exploit that mismatch.
Security Concerns
THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP. The protocol's team warned that now this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.
Nodes will decide to re-enable chains as they are deemed safe.
Impact on Binance Hack
The trading halt disrupted attempts by North Korean hackers to launder funds stolen in last week's $6.3 billion Binance hack. According to Chainalysis, THORChain inadvertently delayed the laundering of a significant amount of stolen funds, preventing all users, including DPRK's money launderers, from using cross-chain swaps.
The disruption came as US authorities pressed crypto infrastructure providers to restrict movement of stolen funds. On Saturday, the FBI urged THORChain node operators to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack.
Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain's bridges.
Protocol's Defense
THORChain has continued to defend its role as neutral, permissionless infrastructure amid scrutiny over stolen funds moving through the protocol. In its third-quarter report, the project maintained that position despite pressure to block transactions linked to hacked funds.
THORChain founder John-Paul Thorbjornsen separately defended the protocol's commitment to permissionless transactions, warning against shutting it down in response to pressure over illicit funds.
Related
