THORChain halts swaps after bug exposes cross-chain refund risk

Traders Union
All News
Crypto
THORChain halts swaps after bug

Highlights

THORChain halts swaps across 10 networks, including Bitcoin and Ethereum, after a bug creates a risk of cross-chain refund exploitation during block reorganizations.
Chainalysis reports the emergency pause disrupts North Korean hackers attempting to launder funds stolen in last week's $6.3 billion Binance hack via THORChain.
THORChain reiterates its neutrality as U.S. authorities urge node operators to block addresses tied to TraderTraitor, despite increasing regulatory scrutiny of cross-chain protocols.

Bug response and network pause

As reported by Cointelegraph, THORChain says the incident begins at 11:34 UTC on Saturday, when a one-block reorganization on Ethereum removes a 10 ETH deposit that the protocol had already credited.

When the swap fails to meet its price limit, THORChain issues a refund against funds the vault never receives. The sender’s actual deposit is also refunded, producing an extra 10 ETH payout and triggering an automatic pause.

The protocol says the flaw creates a mismatch in which THORChain can refund a payment that Ethereum no longer recognizes as having happened. Its team warns that, once the issue is public, a malicious actor could exploit future block reorgs on external chains by submitting a new transaction with the same nonce and drawing funds from THORChain vaults.

Node operators pause swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continues on Avalanche, Base and XRP. THORChain says nodes will decide when to re-enable chains as they are deemed safe.

Pressure over stolen funds and protocol neutrality

The emergency halt also disrupts attempts by North Korean hackers to launder funds stolen in last week’s $6.3 billion Binance hack, according to Chainalysis. The blockchain analytics firm says the pause prevents all users, including DPRK-linked money launderers, from using most of THORChain’s cross-chain swap routes until service resumes.

The disruption comes as U.S. authorities press crypto infrastructure providers to restrict the movement of stolen funds. On Saturday, the FBI urges THORChain node operators, DeFi services and other virtual asset providers to block transactions tied to addresses used by TraderTraitor to move proceeds from the Binance hack.

THORChain has previously faced scrutiny because North Korean hackers have used the protocol to swap cryptocurrencies after earlier attacks. In its third-quarter report, the project says it maintains its position as neutral, permissionless infrastructure despite pressure to block transactions linked to hacked funds.

Founder John-Paul Thorbjornsen separately defends that stance, saying shutting the protocol down in response to pressure over illicit flows would mean the experiment has failed. He argues THORChain remains a venue for unencumbered and neutral settlement, even as regulators and investigators intensify scrutiny of cross-chain infrastructure.

Our earlier article on Cohere’s planned acquisition of AI cybersecurity startup AISLE highlighted how the deal would add software vulnerability detection to Cohere’s expanding AI business alongside its merger with Aleph Alpha. We noted that AISLE’s tools had already identified hundreds of previously unknown bugs, underlining how fast-moving security research is becoming a core requirement as critical digital systems scale.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.