THORChain Pauses Cross-Chain Swaps After Ethereum Reorg Bug, Disrupting Binance Hack Laundering

A glitch tied to an Ethereum block reorganization pushed THORChain node operators to freeze swaps on 10 networks on Saturday, among them Bitcoin, Ethereum, Solana and Tron. Avalanche, Base and XRP kept trading. The trouble began at 11:34 UTC, when a one-block reorg wiped out a 10 ETH deposit the protocol had already counted. The related swap missed its price limit, so THORChain sent back funds it never actually held. The sender’s real deposit was returned too, creating an extra 10 ETH payout and triggering an automatic stop.

Why the Reorg Bug Is Risky

A reorg occurs when Ethereum swaps a recent block for a competing one. The flaw means THORChain can repay a transaction the chain no longer recognizes. The team warned that, now the issue is public, an attacker could reuse the same nonce after any reorg on an external chain and collect money from the vaults. Nodes will bring chains back one at a time once they judge them safe.

Binance Hack Funds and North Korean Hackers

Chainalysis said the pause may have unintentionally delayed laundering of the $6.3 billion Binance theft, since neither the attackers nor regular users can route through most bridges for now. The FBI had asked node operators, DeFi services and other providers to block addresses used by TraderTraitor, the group behind the attack.

THORChain’s Neutrality Debate

North Korean hackers have used the network before, yet the project insists it is neutral, permissionless infrastructure. Founder John-Paul Thorbjornsen argued that shutting it down under pressure would mean the experiment has failed.