THORChain halts cross-chain swaps after 10 ETH refund error

The incident began at 11:34 UTC when an Ethereum chain reorganization removed a transaction from the official record after THORChain had already processed it. Because the protocol attempted to refund a swap that technically never reached its vault, it erroneously paid out 10 ETH from its own reserves. The system’s automated solvency checker identified the discrepancy within minutes, triggering a protocol-wide halt to prevent further drainage.

Node operators suspended trading on networks including Bitcoin, Solana, and BNB Smart Chain to allow developers to patch the vulnerability. While the recipient of the errant refund returned the funds, the pause persisted, complicating efforts by suspected North Korean money launderers to move assets stolen during the October 29 Binance breach. Chainalysis confirmed that the technical failure delayed these illicit transfers, though THORChain clarified the shutdown was a security safeguard rather than a targeted intervention against specific wallets. The FBI has previously pressured decentralized services to block addresses associated with the TraderTraitor group, sparking ongoing debates about the protocol's resistance to censorship.