THORChain Halts Cross-Chain Swaps Over Security Flaw, Disrupting Laundering of Binance Hack Funds

THORChain, a decentralized cross-chain trading protocol, has temporarily suspended asset swaps across major blockchains after discovering a security vulnerability.

Cointelegraph reported on November 1 that THORChain launched an emergency response after identifying a refund-processing error tied to a blockchain reorganization on the Ethereum network on October 31. The issue halted asset swaps across 10 networks, including Bitcoin, Ethereum, Solana and Tron.

The problem stemmed from a "reorg," in which a recently created block on Ethereum was replaced by another block. In that incident, a 10 Ether deposit disappeared during the reorganization, but THORChain's system had already recorded the deposit. The trade later failed to meet its preset price conditions, triggering a refund process that mistakenly paid out an extra 10 Ether beyond the actual deposit.

THORChain said it detected the risk that the flaw could be exploited and automatically halted trading. Swaps remain available on Avalanche, Base and the XRP network. Service on the suspended networks will be restored in phases after node operators verify their safety.

The suspension also appears to have affected the movement of funds tied to the Binance hack. Blockchain analytics firm Chainalysis said THORChain's outage disrupted efforts by North Korean hackers to move stolen digital assets onto other blockchains.

"THORChain has unintentionally delayed a substantial amount of laundering of funds stolen from Binance," Chainalysis said. Until service is restored, neither regular users nor North Korean hackers can use THORChain's core cross-chain swap functions.

Earlier, the Federal Bureau of Investigation identified the North Korean hacking group TraderTraitor in connection with the roughly $6.3 billion Binance hack that occurred on October 29. The FBI asked THORChain node operators and decentralized finance service providers to block transactions involving addresses linked to the stolen funds.

THORChain, meanwhile, has maintained that decentralized infrastructure should remain neutral and allow permissionless transactions despite criticism that it has been used to move illicit funds. Founder John-Paul Thorbjornsen has argued that shutting down the protocol in response to outside pressure could undermine the core purpose of decentralized payment systems.