Mentioned in This Article
1. What happened to THORChain on Saturday?
THORChain, the cross-chain swap protocol, paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, after a one-block Ethereum reorganization on Saturday, October 31, exposed a refund flaw. Chainalysis said on Sunday that the THORChain pause may have delayed the movement of funds stolen from Binance, because the emergency stop blocks every user, including the North Korean launderers.
The trouble began at 11:34 UTC. According to THORChain, a block on Ethereum was replaced by a competing block, and the replacement erased a 10 ETH deposit that the protocol had already credited. The swap tied to that deposit then failed to meet its price limit, so the system tried to return the funds. Because the deposit no longer existed on the canonical chain, the vault had never actually received the money it was refunding.
The sender's original deposit was also returned, which produced an extra 10 ETH payout. That surplus tripped an automatic safeguard and the network halted. Node operators then extended the pause to swaps on ten networks. THORChain's network status page showed trading still running on Avalanche, Base and XRP.
2. How did an Ethereum reorg trigger a double refund?
A reorganization, usually shortened to reorg, happens when a blockchain discards one or more recent blocks in favor of a competing version of the chain. Reorgs of a single block are a normal feature of proof-of-stake and proof-of-work networks, which is why exchanges and bridges typically wait for several confirmations before treating a deposit as final.
In this case the protocol credited a deposit that later vanished from Ethereum's canonical history. When the swap could not be completed at the requested price, THORChain issued a refund for an amount its vault had never held. The genuine deposit from the sender was refunded as well, so the vault paid out 10 ETH more than it should have. The result was a mismatch between what THORChain believed it had received and what Ethereum recorded.
That gap is the core of the flaw. The protocol was willing to return a payment that Ethereum no longer recognized, and a malicious actor could in principle engineer the same mismatch on purpose and be paid from the protocol's vaults.
3. Why does the bug matter now that it is public?
A team member at THORChain warned that, with the flaw now known, an attacker could reuse a nonce in a fresh transaction while an external chain is reorganizing and then be paid from THORChain vaults. A nonce is a counter that orders transactions from one account, and reusing it lets a second transaction replace the first.
The warning explains why the pause was extended beyond the automatic trigger. A bug that is understood by only a few people is a contained risk. Once it is described in public, anyone with the technical skill to time a transaction around a reorg can try to exploit it. Pausing swaps gives developers time to patch the refund logic before an attacker can test it against real liquidity.
The same team statement said that nodes will re-enable chains once they are judged safe. No date for resumption was given, and the order in which individual networks come back online has not been set out.
4. How does the pause affect the Binance hackers?
Chainalysis said the halt disrupted North Korean hackers who were trying to launder proceeds from last week's $6.3 billion Binance theft. In its statement on Sunday, the blockchain analytics firm said THORChain had inadvertently delayed the laundering of a significant amount of the stolen funds, since the emergency pause shuts every user out of cross-chain swaps, including the people moving money for the Democratic People's Republic of Korea.
Chainalysis added that until the service returns, neither the hackers nor anyone else can swap through most of THORChain's bridges. The effect is a side effect of a software fault and not a deliberate move against the thieves. THORChain's own explanation of the stoppage makes no reference to the Binance funds.
For investigators, the delay has practical value. Cross-chain swaps are one of the main ways stolen assets are converted from one network to another, which breaks the visible trail that analysts follow. Every day that route is closed leaves the stolen coins sitting in addresses that law enforcement and analytics firms are already watching.
5. What did the FBI ask THORChain to do?
The pause coincided with a push by US authorities for crypto infrastructure providers to restrict the movement of stolen money. On Saturday, the Federal Bureau of Investigation urged THORChain node operators, decentralized finance services and other virtual asset providers to block transactions tied to addresses that TraderTraitor, the North Korean group blamed for the theft, has used to launder the Binance proceeds.
THORChain has no central operator that can simply comply with such a request. Swaps are processed by a network of independent node operators, and any decision to screen or reject specific addresses would need to be taken by those operators themselves. That structure is the reason the FBI's appeal was addressed to node operators and not to a company.
6. Why is THORChain a recurring laundering route?
North Korean hackers have used THORChain before to swap stolen crypto without asking permission from anyone. The protocol lets users exchange native assets such as Bitcoin and Ethereum directly across chains, without wrapping them or relying on a custodian, and without requiring identity checks.
The project has continued to describe itself as neutral, permissionless infrastructure even as scrutiny of stolen money passing through it has grown. In its third-quarter report, it said it had held that position despite pressure to block transactions linked to hacked funds.
Founder John-Paul Thorbjornsen has defended permissionless transactions and cautioned against shutting the protocol down in response to pressure over illicit flows. He argued that if node operators took the protocol offline the following week, the experiment would be over. In a second statement he said that outcome would end the last neutral settlement venue, leave users with no alternative and cause the protocol to fail.
7. What does the incident show about cross-chain design?
The episode illustrates a recurring difficulty for systems that connect separate blockchains. Each network has its own idea of when a transaction is final, and a bridge or swap protocol has to decide how much to trust a deposit that has been seen but could still be reversed. Treating a deposit as settled too early creates exactly the opening that appeared on Saturday.
A one-block reorg is a minor event for Ethereum itself, and the network continued to operate normally. The consequences were confined to an application that acted on a deposit before its permanence was assured. That distinction matters for users, because the weak point was in the swap protocol's accounting and not in the base chain.
The automatic halt also worked as designed. The surplus of 10 ETH was small, but the system detected that its books no longer balanced and stopped itself before a larger discrepancy could be created. Whether that kind of circuit breaker is welcome or not depends on the viewpoint: for liquidity providers it limits losses, while for traders it removes access to swaps until operators decide it is safe to resume.
8. What is THORChain and how do its swaps work?
THORChain is a decentralized liquidity network built to move value between blockchains without a custodian in the middle. Users send a native asset, such as bitcoin or ether, to a vault controlled jointly by the network's node operators, and the protocol pays out the destination asset from a pool on the other side. The native token RUNE serves as the pairing asset in those pools.
Because vaults are controlled by many independent nodes rather than a single company, no one party can approve or reject an individual swap. That design is what attracts users who want to avoid centralized exchanges, and it is also why the protocol is hard to police. Nodes must observe deposits on each external chain and agree on what they saw before the network acts, which makes every connected blockchain a source of risk if its history changes after the fact.
Observing deposits is only half of the job. The protocol also signs and broadcasts outbound payments, including refunds when a swap cannot be completed at the price the user set. A refund is therefore a real transfer out of a vault, and an error in deciding whether a refund is owed becomes a loss of funds held by liquidity providers.
9. Why do reorgs create risk for swap protocols?
Finality is the point at which a transaction can no longer be reversed. On many networks it is probabilistic, rising with each additional block, so applications that move assets between chains normally wait for several blocks before acting. A shorter wait means faster swaps but a larger window in which an observed deposit can disappear.
Protocols that act quickly are exposed to a specific attack pattern. An attacker sends funds, waits for the protocol to credit them, and then relies on the chain to drop the transaction, leaving the protocol to account for money it never kept. Defenses include longer confirmation requirements, checks that compare internal records with the canonical chain before any payout, and halts that trigger when balances diverge. The Saturday incident shows the last of these doing its job after the first two had not caught the problem.
10. What happens next for THORChain?
The immediate question is when node operators will switch swaps back on for the paused networks and whether the fix covers only Ethereum or every external chain, since the nonce-reuse warning applies to any chain that can reorganize. THORChain has said chains will return once they are considered safe, and has not committed to a schedule.
The second question is how the Binance laundering effort proceeds once the route reopens. The FBI's request to block addresses tied to TraderTraitor remains in place, and the project's stated commitment to staying neutral means the response from node operators is still unresolved. Observers will be watching for any change in how the network treats flagged addresses, and for further statements from Chainalysis on where the stolen funds go while swaps remain limited.