Ethereum reorg caused THORChain to issue a double refund, triggering an emergency pause that blocked cross-chain swaps and inadvertently disrupted laundering of stolen Binance funds.
Security & Exploits ·
Chainalysis reported that a chain reorganization on Ethereum on the morning of October 31 (EDT) led THORChain to incorrectly process a double refund for a user who had sent 10 ETH. The erroneous transaction prompted an emergency halt to the platform, which suspended cross-chain swaps across most of THORChain's bridge infrastructure for all participants on the network.
The outage disrupted activity across the protocol without distinction between standard users and bad actors. Among those affected were participants attempting to move stolen Binance funds through the network as part of a laundering operation tied to North Korea. The timing of the pause delayed their ability to obscure the origin and movement of the compromised assets.
The incident reveals how protocol-level bugs can have unintended consequences for illicit activity detection and fund recovery. Whether the outage lasted long enough to allow investigators to intervene, or what broader safeguards THORChain has since implemented, remain unclear.