THORChain halts trading on 10 chains after Ethereum reorg triggers double refund
Coinyong
RUNE
An Ethereum block reorg on Oct. 31 led THORChain to pay out 10 ETH it never received, triggering an automatic halt.
Trading on 10 chains, including Bitcoin, Ethereum and Solana, remained halted as of midday Nov. 2.
Chainalysis said the halt delayed laundering of funds stolen from Binance; RUNE fell more than 18% in 24 hours.
THORChain, a decentralized exchange that lets users swap coins across blockchains without an intermediary, halted trading on 10 chains, including Bitcoin and Ethereum. A block reorganization on Ethereum caused the protocol to refund 10 ETH it had never received, and node operators then halted other chains as a precaution. THORChain published a breakdown on its official X account on the morning of Nov. 2 KST, and the halt was still in place at midday.
A dropped block, and 10 ETH refunded twice
According to THORChain, the incident began at 8:34 p.m. KST on Oct. 31 (11:34 UTC), when Ethereum had a one-block reorg. A reorg happens when two blocks are produced at nearly the same time and only one of them ends up on the canonical chain, while the other is discarded.
The 10 ETH deposit in question sat in the discarded block, but THORChain had already counted it as received. Because the swap failed to meet its price limit, it was set up for a refund, and the user ended up getting back both the money actually sent and the 10 ETH that existed only on THORChain's books. In effect, 10 ETH the vault never received left the vault. "Every node detected the reorg. But the re-check that should have removed the deposit could not get a clear answer in time, so it was finalized," THORChain said.
- Ethereum block reorg; 10 ETH refunded twice
- Solvency checker automatically halts ETH swaps; about two minutes later, node votes halt ETH outbound signing
- Three node votes halt other chains as a precaution
- Chainalysis says laundering of funds stolen from Binance has been delayed
- THORChain posts breakdown on X; the user has returned the 10 ETH
Ten chains halted, four still trading
THORChain listed the halted chains as Cosmos (ATOM), Bitcoin Cash, BNB Smart Chain, Bitcoin, Dogecoin, Ethereum, Litecoin, Solana, Tron and Zcash. Trading continues on Avalanche, Base, THORChain itself (RUNE) and the XRP Ledger. Public THORChain node data at 12:30 p.m. KST on Nov. 2 still showed the 10 chains as halted.
THORChain also explained why the chains cannot simply be reopened. "Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults," it said. Core developers are working on fixes, and "nodes will decide to re-enable chains as they are deemed safe." The user returned the 10 ETH, making the vault whole again.
An emergency halt can be triggered by three node votes and reversed by four counter votes. "Halting a chain does not give those nodes control of the assets," THORChain added.
A North Korean laundering route is blocked too
Blockchain analytics firm Chainalysis wrote on X early on Nov. 1 that "THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance." The emergency pause is "preventing all users, including DPRK's money launderers, from using cross-chain swaps," it said. North Korean hackers have used THORChain to swap coins after previous hacks as well.
Laundering is continuing through other routes. Chainalysis said early on Nov. 2 that North Korea-linked actors had drained $500 million from staging wallets on Tron and begun moving onto Solana. The funds are moving through services and networks including Chainflip, Relay, THORChain and NEAR into dozens of fresh wallets on Ethereum, Bitcoin and other chains, with individual transfers ranging from less than $5,000 to more than $100,000, it said.
RUNE drops 18% in a day
THORChain's RUNE token traded at $0.511 on Binance at 12:30 p.m. KST on Nov. 2, down more than 18% from 24 hours earlier. It was around $0.68 in the 8 p.m. hour on Oct. 31, when the reorg occurred, rose as high as $0.733 in the 1 a.m. hour on Nov. 1, then slid through the morning of Nov. 2, leaving it more than 30% below that high. RUNE is not listed on the Korean won markets of Upbit or Bithumb.