Cross-chain liquidity protocol THORChain suspended cryptocurrency swaps across 10 blockchain networks on October 31 after a one-block Ethereum reorganization exposed a critical refund vulnerability. The emergency shutdown disrupted major networks including Bitcoin, Ethereum, Solana, and Tron.

The move also briefly interrupted efforts by North Korean hackers to move funds stolen in the recent Binance security breach. Blockchain analytics firm Chainalysis said the unexpected suspension temporarily restricted access to cross-chain services used to transfer illicit cryptocurrency.

A One-Block Reorg and a Double Refund

The incident began at approximately 11:34 UTC on Saturday, October 31, when Ethereum underwent a one-block reorganization — an event in which a network replaces a recently confirmed block with an alternative version. The reorganization removed a 10 ETH deposit that THORChain had already recognized, leaving the protocol's accounting out of sync with Ethereum's actual on-chain state.

When the associated transaction failed to satisfy its price requirements, THORChain processed a refund despite never actually receiving the original funds. The system then refunded the sender's genuine deposit as well, producing an additional 10 ETH payout.

The discrepancy triggered THORChain's automatic security protections, prompting node operators to suspend trading across multiple networks. The protocol warned that attackers could potentially exploit similar discrepancies during future reorganizations. Although such events can occur during normal blockchain operations, they create risks for protocols that process transactions before final settlement.

Binance Hackers Caught in the Shutdown

The suspension also complicated efforts to move cryptocurrency stolen in the recent $6.3 billion Binance security breach. According to Chainalysis, North Korean hackers had been using cross-chain infrastructure to transfer stolen assets between blockchain networks, and THORChain's emergency restrictions temporarily prevented those transfers through most of its supported networks.

The FBI previously identified North Korea's TraderTraitor operation as responsible for the Binance attack. U.S. authorities subsequently urged decentralized finance platforms and cryptocurrency service providers to restrict transactions involving identified wallet addresses. THORChain's suspension, however, affected legitimate users alongside suspected illicit actors.

Resumption Rests With Node Operators

Trading remained available on Avalanche, Base, and the XRP Ledger while operators assessed the affected networks. THORChain said node operators would determine when individual networks could safely resume trading. Until operators clear each network, users on the paused chains cannot initiate cross-chain swaps, and the pace and order in which major networks such as Bitcoin, Ethereum, Solana, and Tron come back online will be the key operational details to watch.

The incident highlights the operational risks facing decentralized cross-chain liquidity protocols, which allow users to exchange assets across independent blockchain networks without relying on traditional centralized exchanges. It also renewed questions about how decentralized protocols should respond when criminals exploit permissionless financial infrastructure — underscoring the importance of transaction finality, reliable refund mechanisms, and automated security controls in protecting cross-chain cryptocurrency markets.

Source: CryptoMeter io