THORChain halted swaps across multiple blockchains on Saturday after an Ethereum block reorganization exposed a refund vulnerability in the protocol. The incident prompted node operators to pause swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while activity continued on Avalanche, Base and XRP.
THORChain said the incident began at 11:34 UTC when Ethereum replaced a recent block and removed a 10 ETH deposit that the protocol had already credited. After the swap failed to meet its price limit, THORChain issued a refund for funds the vault had not received. The sender’s original deposit was also refunded, producing an additional 10 ETH payout and triggering an automatic pause.
A blockchain reorganization occurs when a network replaces a recent block with a competing one. In this case, the mismatch between Ethereum’s updated history and THORChain’s records could allow an attacker to repeat a transaction using the same nonce and receive funds from THORChain vaults, according to the protocol’s team.
THORChain said node operators would decide when to restore individual chains after determining that they were safe. The protocol’s status page showed that swaps remained paused on the affected networks, while trading continued on Avalanche, Base and XRP.
The interruption also affected the movement of funds stolen in last week’s $6.3 billion Binance hack. Chainalysis said the emergency pause inadvertently delayed efforts by North Korean hackers to launder the stolen assets, because users—including those attempting to move illicit funds—could not use most of THORChain’s cross-chain bridges.
The disruption followed an FBI request for THORChain node operators, decentralized finance services and other virtual asset providers to block transactions linked to addresses that TraderTraitor allegedly used to launder proceeds from the Binance attack.
North Korean hackers have previously used THORChain to swap cryptocurrencies without permission from a central authority. The protocol has continued to defend its neutral and permissionless model, despite pressure to restrict transactions associated with stolen funds. In a separate statement, THORChain founder John-Paul Thorbjornsen warned that taking the protocol offline would undermine its role as a neutral settlement system.
Sources: Cointelegraph.