THORChain Pauses Swaps on 10 Networks Due to Technical Flaw, Unintentionally Affecting Fund Movements

THORChain has paused swaps across ten networks, including Bitcoin, Ethereum, Solana, and Tron, following the discovery of a technical flaw triggered by an Ethereum block reorganization. This incident, which began on Saturday at 11:34 UTC, coincided with an automatic pause of the protocol’s services. According to Chainalysis, this disruption inadvertently affected attempts by certain actors to move funds allegedly linked to a major exchange hack.

The technical issue arose when a one-block reorganization on the Ethereum network removed a 10 ETH deposit that THORChain had already credited. Subsequently, THORChain issued a refund for funds that the vault had not yet received. Compounding the error, the sender’s original deposit was also refunded, resulting in an additional 10 ETH payout. This overpayment triggered an automatic pause of THORChain’s services.

An Ethereum block reorganization occurs when the network replaces a recent block with an alternative one. This process created a mismatch where THORChain could refund a payment that Ethereum no longer recognized. The protocol team noted that this flaw could potentially be exploited, stating, “Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.”

While swaps were halted on several networks, trading continued on Avalanche, Base, and XRP. THORChain stated that node operators would re-enable chains as they are deemed safe. The pause in services, however, had an unintended consequence: it disrupted the movement of funds potentially linked to illicit activities. Chainalysis reported on Sunday that THORChain had “inadvertently delayed the laundering of a significant amount of funds stolen from Binance.” The firm added that the emergency pause prevented “all users, including DPRK’s money launderers, from using cross-chain swaps” until services were restored.

This incident occurred amidst increased pressure from U.S. authorities on crypto infrastructure providers to restrict the movement of funds linked to illicit activities. On Saturday, the FBI reportedly urged THORChain node operators and other virtual asset providers to block transactions associated with addresses linked to “TraderTraitor,” an entity implicated in laundering proceeds from the Binance hack.

THORChain has historically defended its position as neutral, permissionless infrastructure, even when facing scrutiny over its role in facilitating the movement of funds. In its third-quarter report, the project indicated it maintained this stance despite pressure to block transactions connected to hacked funds. John-Paul Thorbjornsen, THORChain’s founder, also defended the protocol’s commitment to permissionless transactions, warning against shutting down the network in response to pressure over illicit funds. He expressed concern that such actions could signal the end of neutral settlement venues in the cryptocurrency space.

There remains uncertainty regarding when THORChain node operators will re-enable the affected chains and the full extent to which the refund flaw could be exploited. The situation highlights a persistent tension within decentralized finance: balancing the core principles of neutrality and permissionless access with the growing demand from law enforcement and security firms to police illicit financial activity.

Why This Matters

The materials describe a narrow update: THORChain paused swaps across multiple blockchains after an Ethereum block reorganization coincided with a bug where a deposit was credited, then removed by the reorg, and subsequently refunded twice. When node operators will decide to re-enable chains.

Broader Context

Source materials place the factual news in this context: THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron.