THORChain Swap Halt After Reorg Bug Delays Binance Hack Laundering

THORChain swap halt paused cross-chain trades across 10 networks after an Ethereum block reorganization exposed a refund bug, and the outage inadvertently slowed laundering of funds stolen from Binance, according to Chainalysis.

Node operators stopped swaps involving Bitcoin, Ethereum, Solana and Tron after the incident began at 11:34 UTC Saturday. A one-block reorg removed a 10 ETH deposit that THORChain had already credited. When a swap failed its price limit, the protocol issued a refund against funds the vault had never received, and the sender’s original deposit was refunded too, creating an extra 10 ETH payout and triggering an automatic pause.

THORChain said the flaw lets a malicious actor exploit mismatches during external-chain reorgs, potentially drawing funds from vaults. Trading continued on Avalanche, Base and XRP, while nodes will decide when to re-enable chains deemed safe.

Chainalysis said the emergency pause prevented all users, including North Korean money launderers, from using cross-chain swaps, delaying movement of proceeds from the $6.3 billion Binance hack. The FBI had urged THORChain operators and other DeFi services to block transactions linked to TraderTraitor addresses. THORChain founder John-Paul Thorbjornsen defended the protocol’s neutral, permissionless design.