THORChain Refund Bug Triggers Network-Wide Swap Pause

A pause with two very different effects

THORChain’s response to a transaction accounting flaw has exposed a difficult tradeoff. Its emergency pause slowed the movement of funds linked to a Binance theft, while also leaving ordinary users unable to swap assets across most of the networks the protocol supports. THORChain says the underlying bug could put its vaults at risk, so the halt is doing more than interrupting a service: it’s part of the protocol’s attempt to contain a problem it hasn’t fully assessed.

As of Monday afternoon, node data showed swaps halted on 10 networks: ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC. AVAX, Base and XRP remained active. That uneven availability means the effect depends on which chain a user needs; a route that still works for one asset doesn’t make the broader service available. THORChain hadn’t announced when the paused networks would reopen.

Chainalysis said Saturday that the halt had “inadvertently delayed the laundering of a significant amount of funds stolen from Binance.” The wording captures an unusual consequence of the outage: the same interruption that blocks legitimate swaps can also disrupt a thief’s attempt to move assets. The disruption affected hackers and regular users alike by cutting access to most of THORChain’s bridges. This is more significant than it looks, because the protocol’s response to a security issue can alter the options available to everyone using it.

The pause reflects THORChain’s stated approach to security concerns. Co-founder Chad Barraford said on Unchained on Oct. 5 that validators broadly agree to stop trading when a bug or exploit appears, to prevent funds from being taken in a subsequent block. Here’s the thing: halting activity can buy time to investigate, but it also transfers the cost of uncertainty to users who may have had nothing to do with the incident.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

The 10 ETH accounting mismatch

The incident started at 11:34 UTC on Saturday, during a one-block reorganization on Ethereum. A reorganization happens when a chain’s record of recent blocks changes, which can leave a transaction that appeared in one version of the record absent from the version that becomes accepted. THORChain recorded a 10 ETH deposit before Ethereum discarded the block containing it. That sequence left the protocol working from an outdated view of what had actually arrived.

When the requested trade couldn’t execute at the sender’s price, the protocol refunded the deposit it believed it had received—and also returned the actual deposit. The duplicate refund left a THORChain vault short by 10 ETH. The mistake wasn’t simply a failed swap: it was a mismatch between the protocol’s accounting and the external chain’s final record, with the vault covering the difference.

According to THORChain, nodes detected the reorganization, but a follow-up check hadn’t reached a conclusive result before the deposit was finalized. The timing matters. A check that eventually detects a reorganization can still fail to protect funds if the protocol acts on the deposit before that check finishes.

The resulting shortfall triggered an automatic solvency check, which stopped ETH swaps. Node operators blocked outgoing ETH transactions about two minutes later, then a three-node vote paused all chains as a precaution. The sender has since returned the 10 ETH, restoring the balance, the protocol said. That repayment addresses the reported shortfall; it doesn’t by itself establish that the accounting flaw has been fixed.

Vault exposure remains under review

THORChain warned that a reorganization on an external chain could let an attacker submit a new transaction using the same nonce and receive funds from its vaults. The concern is tied to how THORChain interprets events on other networks: if its record of a deposit or transaction diverges from the external chain’s accepted history, its vault could act on an incorrect picture. Core developers are working on fixes, while node operators will resume activity once they consider each chain safe. The protocol hasn’t provided a restart date.

That chain-by-chain decision creates a practical test for the response. Users need more than an assurance that a fix is underway; they need confidence that the relevant chain’s transaction checks are behaving as intended before swaps resume. If you’re working in this space, the episode is a reminder that cross-chain services inherit uncertainty from the networks they connect. A failure on one chain can become a problem for a system that relies on interpreting its transactions correctly.

Security decisions carry wider consequences

The episode lands amid scrutiny of THORChain’s role in crypto theft cases. The FBI, Secret Service and IRS Criminal Investigation have asked infrastructure providers, including THORChain, to refuse transactions involving wallets they associate with North Korea’s TraderTraitor group. Binance has valued its hot-wallet losses at $6.3 billion. Those details frame the current pause as part of a larger debate over what role a decentralized protocol should play when stolen assets pass through its services.

THORChain declined Bitget’s request in September to block hacker wallets. In October, Barraford said he’d ask the protocol’s treasury about refunding fees earned on stolen crypto. Those decisions point to questions about the responsibilities of operators and the limits of intervention, but the immediate incident is narrower: a flaw in transaction accounting prompted validators to halt activity because they feared further losses.

The network has paused before, including a brief shutdown in 2023 over a security threat. A past pause shows that stopping activity is an available response; it doesn’t answer how quickly the current checks can be repaired or how users should judge the safety of each resumed chain. And yet, keeping swaps disabled also has a cost. A service that depends on users’ ability to move assets can lose practical value when access remains uncertain.

What users should watch next

The immediate priority is fixing the reorganization checks and restoring swaps chain by chain. The key question is whether the revised checks can establish that a deposit is settled before THORChain treats it as available for a trade or refund. Until the protocol explains how the fixes address that timing gap, the reason for each reopening will matter as much as the announcement itself.

There’s a hard operational tradeoff here. Pause too late, and a flawed accounting assumption could expose vault funds; pause broadly, and users lose access well beyond the affected transaction. For THORChain, the test is whether it can explain the failure clearly, show that the relevant safeguards have changed, and reopen activity without asking users to treat the restored balance as proof that the risk has passed. The stolen-funds delay may draw attention, but the lasting measure will be whether ordinary users can trust the protocol’s accounting again.

For now, the pause’s scope and duration remain open questions. The incident is a concrete example of how an emergency control can contain one risk while creating another kind of disruption. Not a clean resolution.

Related Listen: Can THORChain Stop North Korea’s Laundering? Its Co-Founder Says It’s Too Decentralized

The post A THORChain Bug Has Slowed North Korean Hackers Laundering Stolen Binance Funds appeared first on Unchained.