THORChain halts swaps after block reorg bug, slowing Binance hackers

THORChain node operators have implemented an emergency pause on swaps involving assets across 10 major blockchain networks, including Bitcoin, Ethereum, Solana, and Tron. The protocol-wide disruption follows the discovery of a technical vulnerability triggered by an Ethereum block reorganization, which has inadvertently hindered the movement of illicit funds associated with the recent $6.3 billion Binance hack.

Understanding the THORChain swap vulnerability

The incident originated at 11:34 UTC on Saturday when a one-block reorganization on the Ethereum network caused a discrepancy in transaction processing. In this instance, a 10 ETH deposit was removed from the chain after THORChain had already credited the user. Because the subsequent swap failed to meet its price limit, the protocol issued a refund for funds that the vault never technically received, while simultaneously returning the original deposit. This resulted in an extra 10 ETH payout and triggered an automatic system-wide pause.

According to the protocol's team, the flaw allows a malicious actor to potentially exploit the mismatch between external chain reorganizations and internal vault payments. By performing a new transaction with the same nonce during a reorg, an attacker could trick the protocol into issuing unauthorized refunds. While trading remains active on Avalanche, Base, and XRP, nodes are currently evaluating the safety of other chains before re-enabling them.

The emergency pause on THORChain swaps has effectively stalled the laundering of stolen Binance hack funds.

Chainalysis reported that this technical disruption has forced a temporary halt to laundering attempts by North Korean hackers linked to the recent Binance security breach. By preventing users from executing cross-chain swaps, the protocol has created a bottleneck for those attempting to move stolen assets. This development coincides with increased pressure from US authorities, including the FBI, who have urged decentralized finance providers to block addresses associated with the TraderTraitor group.

Despite the ongoing scrutiny, THORChain leadership continues to emphasize its commitment to maintaining a permissionless and neutral settlement layer. Founder John-Paul Thorbjornsen has previously warned that compromising the protocol's core principles to block specific transactions would signal the end of the project's utility as a neutral venue for decentralized exchange.

Why it matters

The suspension of services impacts a wide range of users who rely on THORChain for cross-chain liquidity. For participants in the global crypto ecosystem, including those tracking the thorchain binance situation, this event highlights the inherent risks of integrating disparate blockchain networks.

For users in India and South Asia, where interest in decentralized finance is growing rapidly, the incident underscores the vulnerability of cross-chain bridges to technical bugs. As authorities push for stricter oversight of stolen funds, the protocol's ability to remain both neutral and secure remains a central point of debate for the industry.