THORChain halted swaps across multiple blockchains on Saturday after an Ethereum block reorganization exposed a refund bug, inadvertently slowing the movement of funds stolen from Binance. The incident began at 11:34 UTC when a one-block reorg on Ethereum removed a 10 ETH deposit that THORChain had already credited. When the swap failed to meet its price limit, the protocol issued a refund against funds the vault had never received, resulting in an extra 10 ETH payout and triggering an automatic pause.
Node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana, and Tron, while trading continued on Avalanche, Base, and XRP. According to Chainalysis, this emergency halt disrupted attempts by North Korean hackers to launder funds from last week’s $6.3 billion Binance hack. The analytics firm noted that the pause prevented all users, including DPRK money launderers, from using cross-chain swaps until service is restored.
The disruption coincided with US authorities pressing crypto infrastructure providers to restrict stolen funds. On Saturday, the FBI urged THORChain node operators and other virtual asset providers to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack. THORChain founder John-Paul Thorbjornsen defended the protocol’s commitment to permissionless transactions, warning that shutting it down in response to pressure over illicit funds would end the experiment of neutral settlement.
This incident highlights the fragility of cross-chain interoperability protocols when faced with underlying blockchain consensus changes like reorganizations. The technical flaw allowed for double-spending via refunds, demonstrating how minor network events can cascade into significant security breaches in complex DeFi architectures. The automatic pause served as a critical circuit breaker, preventing further exploitation but also revealing the tension between maintaining uptime and ensuring security integrity.
From a regulatory and operational risk perspective, the event underscores the growing friction between permissionless infrastructure and law enforcement demands. While the halt inadvertently aided efforts to freeze stolen assets, THORChain’s leadership remains steadfast in resisting censorship, framing such interventions as existential threats to the protocol's neutrality. This stance may invite increased scrutiny from regulators who view cross-chain bridges as potential chokepoints for illicit finance, potentially leading to stricter compliance requirements or targeted sanctions against specific nodes rather than the protocol itself.
