THORChain has suspended cryptocurrency swaps across 10 blockchain networks after an Ethereum transaction error triggered an emergency shutdown, temporarily disrupting transfers linked to the $6.3 billion Binance hack.
Summary
- THORChain suspended swaps on 10 blockchain networks after an Ethereum block reorganization caused an incorrect 10 ETH refund.
- The protocol’s automatic solvency checker detected the missing funds and halted Ethereum swaps before node operators paused additional chains.
- THORChain said the recipient returned the extra 10 ETH, restoring the affected vault’s balance.
- Chainalysis reported that the interruption temporarily delayed cross-chain transfers linked to the $6.3 billion Binance hack.
- The FBI has urged THORChain operators and other crypto services to block transactions connected to North Korea’s TraderTraitor group.
According to a November 2 statement, the cross-chain protocol encountered a refund problem following an Ethereum block reorganization on October 31. Its security systems detected a missing 10 ETH payment and halted Ethereum swaps before node operators suspended trading on other networks.
Blockchain analytics firm Chainalysis said the interruption prevented users, including suspected North Korean money launderers, from accessing most of THORChain’s cross-chain services.
THORChain halts swaps after 10 ETH refund error
The incident began at 11:34 UTC on October 31, when Ethereum underwent a one-block reorganization that removed a recent transaction from its accepted blockchain history.
The affected transaction involved a 10 ETH deposit intended for a THORChain vault. Although Ethereum subsequently removed the deposit, THORChain had already recognized the incoming payment.
The associated swap failed to meet the sender’s specified price limit, prompting the protocol to issue a refund.
However, because the original deposit was no longer recorded on Ethereum’s accepted chain, THORChain sent 10 ETH from a vault that had not received the corresponding funds.
The sender’s actual deposit was refunded separately, resulting in an additional 10 ETH payout.
THORChain said its automatic solvency checker detected the difference between recorded and available funds, immediately suspending Ethereum swaps.
Within roughly two minutes, node operators stopped outbound Ethereum transaction signing to prevent further withdrawals from the affected vaults.
The team subsequently paused other connected networks while developers examined the problem.
According to the protocol, the recipient returned the extra 10 ETH, restoring the vault’s balance.
Bitcoin and Ethereum among 10 affected networks
The emergency response affected swaps involving Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash.
Trading remained available on Avalanche, Base and XRP Ledger, alongside THORChain’s native network.
The protocol’s network dashboard provides the operational status of supported blockchains as node operators assess when services can resume.
THORChain explained that the problem arose because its systems initially accepted a deposit that Ethereum later removed during the block reorganization.
An Ethereum reorganization occurs when the network replaces a recent block with another version of its transaction history.
In this case, the discrepancy allowed THORChain’s refund process to recognize funds that were no longer present in the accepted Ethereum record.
The team warned that a similar issue could potentially occur following reorganizations on other supported blockchains.
According to THORChain, an attacker could exploit the problem by submitting another transaction using the same nonce after an earlier deposit disappeared from the accepted chain.
Developers are preparing changes intended to prevent the refund process from treating discarded transactions as completed deposits.
The protocol said node operators would determine when individual chains were safe to reopen.
Chainalysis says pause disrupted Binance hackers
The trading interruption occurred as blockchain investigators continued tracing funds stolen from Binance during the October 29 security breach.
Chainalysis said the technical failure had inadvertently delayed the movement of assets linked to the attack.
The company explained that the emergency pause stopped ordinary users and suspected money launderers from accessing most of THORChain’s cross-chain swapping routes.
Earlier, the FBI attributed the Binance attack to North Korea’s state-sponsored TraderTraitor group.
In its October 31 notice, the agency said the attackers had been converting stolen cryptocurrency primarily into Ethereum before attempting further transfers through decentralized finance and instant-swap services.
The FBI urged THORChain node operators, exchanges, blockchain infrastructure providers and other virtual asset businesses to block transactions involving identified attacker addresses.
The agency published a list of cryptocurrency wallets associated with the stolen funds to help service providers identify suspicious transfers.
However, THORChain’s October 31 shutdown resulted from its own technical safeguards, not a decision to selectively block the Binance attackers.
THORChain has faced earlier disputes over stolen funds
The latest interruption follows previous disagreements over whether THORChain should restrict transactions involving stolen cryptocurrency.
In September, Bitget asked the protocol to block identified hacker addresses following a $387.5 million security breach.
THORChain rejected the request, arguing that its emergency shutdown mechanisms were intended to protect network operations, not freeze individual transactions.
Security firm GoPlus subsequently questioned the protocol’s decentralization, pointing to the ability of validators to pause trading and control outbound signing during emergencies.
Earlier in October, independent researcher Andrey Sergeenkov traced fees generated through transactions involving assets stolen from Bitget.
His analysis found that THORChain liquidity providers received $573,226 in fees from the reviewed transactions, while additional affiliate payments reached addresses with varying degrees of connection to the stolen-fund movements.
THORChain experienced a separate security incident in May when a compromised vault lost approximately $10.7 million.
Following that attack, the protocol introduced security changes and an 11-step restart plan before restoring trading in June.
Founder John-Paul Thorbjornsen defended the network’s permissionless design, warning that permanently shutting down THORChain over demands to block illicit transactions would undermine its operating principles.
