THORChain Refund Bug Halts Swaps on 10 Chains After Chain Reorg

Swaps Halted on 10 Networks

THORChain, an automated market maker network built for cross-chain trading, has frozen swaps on most of its chains after a refund flaw left one of its vaults 10 ETH short, and the protocol says the flaw behind the stoppage is now a direct risk to its vaults. Node data showed swaps halted on 10 networks as of Monday afternoon: ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC. None had been switched back on. Only AVAX, Base and XRP were still moving across the network's cross-chain bridges.

The sequence began with a 10 ETH deposit. At 11:34 UTC on Saturday, Ethereum reorganized one block and threw out the block that contained it. THORChain (RUNE) had already logged the deposit, and when the trade could not fill at the sender's price, the network sent back the funds it believed it was holding, then refunded the real deposit as well. The double payout left a vault 10 ETH short. The gap tripped THORChain's solvency checker, which halted ETH swaps automatically. Node operators cut outgoing ETH transactions about two minutes later, and a three-node vote then paused every remaining chain as a precaution. Nodes had seen the reorg, but the follow-up check that should have thrown the deposit out was still inconclusive when the network finalized it, per the protocol's official account. The sender has since returned the 10 ETH, closing the shortfall. Pausing on a bug is how the network is designed to react: co-founder Chad Barraford said on Oct. 5 that a bug or exploit triggers immediate consensus among validators to halt trading, so funds are not stolen in the next block. This time the trigger was an accounting error rather than a live theft.

Laundering Delayed for Stolen Binance Funds

The freeze carried an unintended side effect. In a Saturday post, Chainalysis said the halt had “inadvertently delayed” the laundering of a significant quantity of funds stolen from Binance, because the stoppage locked hackers and ordinary users alike out of most of the network's atomic swap routes. The stolen funds trace back to a breach Binance has put at $6.3 billion in hot wallet losses. US agencies have been pressing infrastructure providers to cut off that flow: the FBI, the Secret Service and IRS Criminal Investigation have asked providers, THORChain (RUNE) among them, to refuse transactions involving wallets tied to North Korea's TraderTraitor group, a hacking cluster blamed for a string of exchange thefts. The protocol has so far declined. In September it turned down Bitget's request to block hacker wallets, and in October Barraford said he would ask the treasury about refunding fees earned on stolen crypto, a step that would break from its hands-off stance.

It is also not the network's first recent stumble: a Zcash matching bug cost 18 node operators about 140 RUNE, as we reported separately. The network has paused before, including a brief halt in 2023 over a security threat, but the current stoppage has stretched from Saturday into Monday afternoon with 10 networks still frozen and only AVAX, Base and XRP trading. The paused list spans the network's biggest liquidity routes, from BTC and ETH to DOGE and SOL. THORChain cautioned that after any reorg on an outside chain, an attacker who reuses a spent transaction nonce could be paid funds straight from its vaults. Core developers are working on fixes, and nodes will switch chains back on only once they judge them safe. The protocol has not described the fixes in detail or named a reopening date.

A Vault Risk With No Fix Date

The episode cuts both ways for a protocol that has staked its identity on neutrality. The same refusal to screen wallets that drew pressure from US agencies is what left a major laundering route frozen from Saturday through Monday, without THORChain (RUNE) ever picking a side. But the refund flaw shows how fragile the accounting behind that neutrality is: a single one-block reorg produced a 10 ETH shortfall that froze nearly the entire network, and until the fixes ship, every reorg on a connected chain is a reusable path into the vaults. What the record does not establish is when trading resumes. With no reopening date and 10 chains still halted, RUNE technical analysis tracks the token's levels while the fix work continues.