THORChain Stops Swaps After Block Reorg Bug, Impacting BNB Hackers

THORChain halted cross-chain swaps across multiple networks after an Ethereum block reorganization (reorg) exposed a refund bug, according to the protocol and Chainalysis. The incident began on Saturday at 11:34 UTC, when an Ethereum reorg removed a 10 ETH deposit that THORChain had already credited—triggering an additional, unintended refund and an automatic pause.

The disruption also appears to have interfered with attempts to move and launder proceeds from last week’s $6.3 billion Binance hack, Chainalysis said. As US authorities have pushed for tighter controls around addresses linked to stolen crypto, the operational halt unintentionally reduced the ability of even illicit actors to use THORChain’s bridges during the emergency shutdown.

Key takeaways

• THORChain reported a refund issue tied to an Ethereum one-block reorg that contradicted what the chain originally showed.
• The bug led to an extra 10 ETH refund payout and then triggered an automatic pause.
• Nodes paused swaps on 10 networks including Bitcoin, Ethereum, Solana, and Tron, while trading continued on Avalanche, Base, and XRP.
• Chainalysis said the halt inadvertently slowed laundering of funds stolen in the Binance hack by preventing cross-chain swaps through THORChain.
• US regulators have urged crypto providers to block transactions tied to Binance-hack laundering addresses, increasing scrutiny on protocols used by attackers.

Ethereum reorg uncovers a refund mismatch

THORChain said the incident started at 11:34 UTC on Saturday when a one-block reorganization on Ethereum replaced a recently recognized block with an alternative. In the process, a 10 ETH deposit that THORChain had credited was no longer recognized as having occurred on the Ethereum chain.

When the swap later failed to satisfy its price limit, THORChain executed a refund using funds from a vault that had never received the deposit Ethereum no longer acknowledged. The sender’s actual deposit was also refunded, resulting in an additional extra 10 ETH being paid out—after which THORChain’s system triggered an automatic pause.

In a public explanation, THORChain described the core problem as an inconsistency between what THORChain’s logic believed had happened and what the Ethereum network ultimately finalized after the reorg. The protocol warned that the mismatch could be exploitable if an attacker could recreate the conditions that led to the over-refund.

“Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,” THORChain said in its statement.

Multi-chain pause while operators decide what’s safe

Following the incident, THORChain node operators paused swaps involving assets on 10 networks. Those included major ecosystems such as Bitcoin, Ethereum, Solana, and Tron. At the same time, THORChain indicated that trading continued on a limited set of chains—specifically Avalanche, Base, and XRP—based on its network status page.

THORChain said its nodes would only re-enable chains after operators assessed that the routes were safe again. The practical effect for users is straightforward: swapping is not uniformly available across the protocol, and traders relying on specific liquidity paths may face temporary route closures even if parts of THORChain remain operational.

Cross-chain halt disrupts Binance-hack laundering attempts

Chainalysis linked the swap interruption to broader efforts to launder funds from the Binance hack. In a Sunday assessment, the firm said the THORChain emergency pause inadvertently delayed the movement of at least some stolen funds by preventing cross-chain swaps across the protocol.

Chainalysis described the shutdown as “preventing all users, including DPRK’s money launderers, from using cross-chain swaps.” It added that until the service is restored, “neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.”

This matters because cross-chain infrastructure can be used to break the on-chain traceability of stolen funds. By halting swaps on most bridge routes, THORChain effectively reduced the attacker’s ability to exchange assets into different forms or relocate them across networks during the window when funds are most actively moved.

Regulatory pressure and THORChain’s permissionless stance

The incident arrives amid heightened scrutiny over how crypto infrastructure handles stolen funds. US authorities have urged platforms to block transaction activity associated with addresses used by “TraderTraitor,” who authorities have tied to laundering proceeds from the Binance attack. On Saturday, the FBI urged THORChain node operators, DeFi services, and other virtual asset providers to restrict transactions connected to those laundering addresses.

THORChain has previously argued for maintaining neutral, permissionless operation even under pressure. In its third-quarter report, the project said it continued to uphold that stance as reflected in its reporting. Separately, founder John-Paul Thorbjornsen defended the protocol’s commitment to permissionless settlement in remarks posted on X, warning that turning the protocol off in response to external pressure would end the experiment.

Earlier coverage also noted that North Korean hackers have used THORChain for permissionless swapping following prior attacks. While the details of that activity were not elaborated in this account, the broader implication is clear: when protocols like THORChain pause for technical reasons, they can temporarily disrupt both legitimate and malicious users—an asymmetry that can affect real-time crime-funding flows.

As operators work through the reorg-triggered refund issue, readers should watch for two things next: how quickly THORChain re-enables the paused networks, and whether additional safeguards are communicated to address how reorg conditions could lead to inconsistent deposit recognition across external chains.