THORChain paused cross-chain swaps on Saturday after a glitch triggered by a block reorganization on Ethereum. Nobody hacked the protocol, yet the side effect was loud: according to Chainalysis, the pause delayed the laundering of funds stolen from Binance. If you don't follow cross-chain bridges, it helps to see how one discarded block stopped an entire service.
What exactly broke in THORChain?
The incident began at 11:34 UTC on Saturday. Ethereum went through a one-block reorganization, and a 10 ETH deposit that THORChain had already credited vanished from the chain. The protocol never noticed.
The swap tied to that deposit missed its price limit, so THORChain started refunding the sender. But the vault had never received those 10 ETH. On top of that, the sender's real deposit was refunded too. The result was an extra 10 ETH payout, and it set off an automatic pause.
How does a block reorg break a bridge?
A reorganization (reorg) happens when a network replaces a recent block with a competing one. Regular users never see it: the transaction just lands in the next block. For a bridge between networks it is a risk, because the bridge reacts to events on someone else's chain.
Here is how the bug played out step by step.
- Deposit: a user sends 10 ETH, THORChain sees the transaction and credits it.
- The block holding that deposit is dropped, and the final Ethereum history has no such transaction.
- The swap misses its price limit, so the protocol triggers a refund.
- Money leaves the vault for the sender, even though the vault received nothing.
- An attacker could repeat the trick by sending a new transaction with the same nonce (the sender's sequence number for an operation).
"Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults."
- THORChain team, from the protocol's statement on the incident
Which networks are on pause?
THORChain nodes (the independent operators that run the network) stopped swaps for assets on 10 blockchains. They include Bitcoin, Ethereum, Solana and Tron. Trading continues on Avalanche, Base and XRP. Nodes will switch chains back on one at a time, once they judge each one safe.
Why did the pause hit the Binance hackers?
THORChain is permissionless, so anyone can swap assets between networks there without signing up. North Korean groups have used it after earlier attacks. On Saturday the FBI urged THORChain nodes, DeFi services and other virtual asset providers to block addresses that TraderTraitor uses to launder money from the $6.3 billion Binance hack.
The protocol did not freeze addresses and still sticks to its role as neutral infrastructure. The glitch did part of that job for it. "THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance," Chainalysis said on Sunday. While the service is offline, neither hackers nor ordinary users can swap through most of its bridges.
Founder John-Paul Thorbjornsen warned that shutting THORChain down under pressure would end the experiment in neutral settlement.
Binance itself has resumed withdrawals in the meantime. DefiLlama data shows $5.8 billion in net outflows over 24 hours, though the exchange still holds about $171 billion in customer assets.
What should users expect next?
For anyone using cross-chain swaps, the takeaway is practical. Check the status of the network you need on THORChain's status page before a big operation, because the pause caught everyone, not only launderers. We at Kurslog advise against leaving such swaps to the last minute.
Will the chains come back with the flaw already closed? The protocol has not promised that, and node operators will decide chain by chain.
Comments
Your email address will not be published. Required fields are marked *