THORChain halts swaps on 10 networks after an Ethereum reorg exposed a double-refund bug
Serguey Asael Shinder1 min readOn Saturday an Ethereum block reorganisation exposed a refund bug in THORChain, and its node operators stopped swaps touching assets on 10 chains, among them Bitcoin, Ethereum, Solana and Tron, Cointelegraph reported. According to THORChain, the incident began at 11:34 UTC, when a one-block reorg on Ethereum removed a 10 ETH deposit that THORChain had already credited.
When the swap then failed its price limit, THORChain issued a refund against funds its vault had never received, and the sender's real deposit was refunded as well, an extra payout of 10 ETH that set off an automatic pause. The protocol's team warned that, now that the flaw is public, every reorg on an external chain could let a malicious actor send a new transaction with the same nonce and be paid from THORChain's vaults. Trading continued on Avalanche, Base and XRP, according to the network status page, and THORChain said nodes will re-enable chains as they are judged safe.
Chainalysis said on Sunday that the halt had inadvertently delayed the laundering of a significant amount of funds stolen in the Binance hack, which the FBI has attributed to North Korea's TraderTraitor group, because until the service returns neither the hackers nor anyone else can swap through most of THORChain's bridges.
What it means
The bug is about finality: THORChain credited a deposit on a chain whose recent blocks can still be replaced. Until the chains reopen, users with funds in flight are waiting, and the fix that matters is how many confirmations THORChain will require before it treats a deposit as real.