THORChain pauses swaps after Ethereum block reorg bug

THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana, and Tron. The halt occurred on Saturday after an Ethereum block reorganization exposed a refund bug. The incident began at 11:34 UTC when a one-block reorganization removed a 10 ETH deposit that THORChain had already credited. When the swap failed to meet its price limit, the protocol issued a refund against funds the vault had never received. The sender's actual deposit was also refunded, resulting in an extra 10 ETH payout which triggered an automatic pause.

The newly discovered flaw allows THORChain to refund a payment that Ethereum no longer recognizes as having happened. The protocol's team stated that now that the bug is public knowledge, malicious actors could exploit block re-orgs to perform new transactions with the same nonce and receive funds from THORChain vaults. THORChain stated that nodes will decide to re-enable chains as they are deemed safe.

The trading halt disrupted attempts by North Korean hackers to launder funds stolen in last week's $6.3 billion Binance hack. Chainalysis stated that the emergency pause is preventing all users, including DPRK's money launderers, from using cross-chain swaps. On Saturday, the FBI urged THORChain node operators, DeFi services, and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack. THORChain founder John-Paul Thorbjornsen defended the protocol's commitment to permissionless transactions and warned against shutting it down in response to pressure over illicit funds.