THORChain halted swaps across multiple blockchains on Saturday after an Ethereum block reorganization exposed a refund bug — a disruption that may have inadvertently slowed the movement of funds stolen from Binance, according to blockchain analytics firm Chainalysis.

THORChain is a decentralized cross-chain protocol that lets users swap cryptocurrencies directly between networks such as Bitcoin and Ethereum, with funds held mid-swap in vaults controlled by its node operators.

According to THORChain, the incident began at 11:34 UTC on Saturday, when a one-block reorganization on Ethereum removed a 10 ETH deposit that the protocol had already credited. Because the swap failed to meet its price limit, THORChain issued a refund against funds its vault had never received. The sender's actual deposit was refunded as well, producing an extra 10 ETH payout and triggering an automatic pause.

An Ethereum block reorganization, or reorg, occurs when the network replaces a recent block with a competing one. The newly discovered flaw allows THORChain to refund a payment that Ethereum no longer recognizes as having happened — a mismatch that a malicious actor could potentially exploit. A nonce, meanwhile, is the sequential number Ethereum attaches to every transaction sent from an account, ensuring it can only be processed once.

“Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,” the protocol's team said in an X post.

THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP, according to the protocol's network status page. “Nodes will decide to re-enable chains as they are deemed safe,” THORChain said, without offering a timeline for the reactivations.

Emergency pause delays Binance hackers' fund movements

The trading halt also disrupted attempts by North Korean hackers to launder funds stolen in last week's $6.3 billion Binance hack, according to Chainalysis.

“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis said on Sunday, explaining that the emergency pause is “preventing all users, including DPRK's money launderers, from using cross-chain swaps.”

“Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain's bridges,” Chainalysis added.

The disruption came as US authorities pressed crypto infrastructure providers to restrict the movement of stolen funds. On Saturday, the FBI urged THORChain node operators, DeFi services and other virtual asset providers to block transactions associated with addresses used by the TraderTraitor group — a North Korea-linked hacking collective — to launder proceeds from the Binance hack.

THORChain's RUNE token jumped 13% after Binance's record $6.3 billion hack, as Cointelegraph previously reported.

North Korean hackers have used THORChain to permissionlessly swap cryptocurrencies following previous attacks. Despite scrutiny over stolen funds moving through the protocol, THORChain has continued to defend its role as neutral, permissionless infrastructure. In its third-quarter report, the project said it maintained that position despite pressure to block transactions linked to hacked funds.

THORChain founder John-Paul Thorbjornsen separately defended the protocol's commitment to permissionless transactions, warning against shutting it down in response to pressure over illicit funds.

“IMO if THORNodes decided to take the protocol offline next week then the experiment is over,” he said in an X post. “The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”