Block reorganization bug forces THORChain to suspend operations, hampering Binance theft laundering
A refund vulnerability triggered by an Ethereum block reorganization forced THORChain to suspend swap functionality across 10 blockchain networks, unintentionally hindering efforts to launder assets from the $6.3 billion Binance security breach.
On Saturday, THORChain suspended cross-chain swap operations following the discovery of a refund vulnerability exposed by an Ethereum block reorganization, a move that may have unintentionally impeded the transfer of assets taken from Binance, as reported by Chainalysis.
The incident commenced at 11:34 UTC on Saturday when a single-block reorganization on the Ethereum network eliminated a 10 ETH deposit that THORChain's system had already processed and credited, according to THORChain's statement. Following the swap's failure to satisfy its designated price threshold, THORChain executed a refund for funds that the vault had not actually received. The sender's genuine deposit also received a refund, creating a duplicate 10 ETH disbursement, which subsequently activated an automatic system pause.
A block reorganization, commonly referred to as a reorg, on Ethereum occurs when the network substitutes a recently validated block with an alternative competing block. This newly identified vulnerability enables THORChain to issue refunds for payments that Ethereum's ledger no longer acknowledges as valid transactions. Such a discrepancy presents opportunities for exploitation by malicious parties.
Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.
THORChain team
Swap operations involving digital assets across 10 different blockchain networks, including Bitcoin, Ethereum, Solana and Tron, were suspended by THORChain node operators, while transactions on Avalanche, Base and XRP networks remained operational, according to information from the protocol's network status dashboard.
Nodes will decide to re-enable chains as they are deemed safe.
THORChain
Emergency pause delays Binance hackers' fund movements
The suspension of trading operations also interfered with North Korean threat actors' efforts to launder proceeds from the previous week's $6.3 billion Binance security breach, as detailed by Chainalysis.
THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.
Chainalysis
According to Chainalysis, the emergency suspension is "preventing all users, including DPRK's money launderers, from using cross-chain swaps."
Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain's bridges.
Chainalysis
This interruption occurred while United States authorities intensified pressure on cryptocurrency infrastructure operators to prevent the transfer of misappropriated digital assets.
The FBI issued an urgent request on Saturday to THORChain node operators, decentralized finance platforms and other virtual asset service providers, calling for the blocking of transactions connected to wallet addresses utilized by TraderTraitor for laundering proceeds obtained from the Binance security incident.
Following earlier cybersecurity incidents, North Korean threat actors have leveraged THORChain's permissionless infrastructure to exchange cryptocurrencies without requiring authorization.
Despite this, THORChain has consistently maintained its stance as neutral, permissionless infrastructure while facing increasing examination regarding stolen assets being transferred through its platform.
The project reaffirmed this position in its quarterly report for the third quarter, stating it upheld its principles despite mounting pressure to prevent transactions associated with compromised funds.
In a separate statement, THORChain founder John-Paul Thorbjornsen defended the protocol's dedication to maintaining permissionless transaction capabilities, cautioning against shuttering the platform in reaction to demands related to illicit fund movements.
IMO if THORNodes decided to take the protocol offline next week then the experiment is over. The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.
John-Paul Thorbjornsen, THORChain founder