THORChain suspended cross-chain swaps on 10 networks after a one-block Ethereum reorganization exposed a flaw in how the protocol handled refunds. The pause affected assets connected to Bitcoin, Ethereum, Solana, Tron, Dogecoin, Litecoin, Bitcoin Cash, BNB Smart Chain, Cosmos and Zcash, while swaps continued on Avalanche, Base and XRP at the time of the halt.
The planned swap then missed its price limit. THORChain refunded the credited deposit even though the vault no longer had the corresponding funds, while the sender also received a refund after Ethereum discarded the original deposit. That sequence produced an additional 10 ETH payout and triggered an automated safety pause.
The vulnerability created a mismatch between THORChain’s accounting and the external blockchain’s final record. THORChain warned that, once the mechanism was public, an attacker could potentially submit a replacement transaction using the same nonce after a reorganization and receive funds from a vault for a deposit that was no longer recognized by the originating network. The protocol’s automated solvency check detected the shortfall, and operators halted activity on Ethereum before pausing other connected chains as a precaution.
The immediate loss was later covered when the user returned the 10 ETH, but the incident left the broader technical issue unresolved while developers examined the reorganization risk. THORChain said individual chains would be restored when node operators considered them safe, meaning the underlying blockchains themselves continued operating even where THORChain’s swap routes were unavailable.
The freeze also interrupted the movement of assets stolen in the Binance attack disclosed on Oct. The FBI said TraderTraitor, which it attributed to North Korean actors, stole more than $6 billion in virtual assets and converted much of the haul into Ether before attempting further laundering through decentralized-finance and instant-swap services. US authorities urged THORNode operators, DeFi platforms, RPC providers, exchanges and blockchain-analysis firms to block transactions connected with the identified addresses.
The pause therefore restricted access to most of THORChain’s cross-chain routes for all users, including actors attempting to move the stolen funds. That effect was incidental to the software-triggered safety response rather than a reported decision by THORChain to selectively block the Binance-related addresses. The episode renewed scrutiny of THORChain’s permissionless design, which its leadership has defended even as stolen assets from earlier attacks have moved through the network.