The emergency stop on THORChain that, per Chainalysis, held up North Korean hackers trying to move money stolen from Binance was set off by a refund bug, according to THORChain’s own account, and the protocol warned that the flaw behind it is now a risk to its vaults.
As of Monday afternoon, THORChain’s node data showed swaps still halted on 10 networks: ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC. None had been switched back on. AVAX, Base and XRP were trading.
Pausing on a bug is how the network was meant to react. THORChain co-founder Chad Barraford said on Unchained on Oct. 5 that “when there’s a bug or an exploit on Thorchain, there is a wide consensus immediately amongst all validators that we need to, you know, pause trading” so that “funds don’t get stolen in the next block or in five minutes or whatever.”
Chainalysis said on Saturday that the pause “inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” because the halt locked hackers and ordinary users alike out of most of THORChain’s bridges.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
A Deposit That Never Landed
The trouble began with a 10 ETH deposit that THORChain logged before Ethereum threw out the block containing it, in a one-block reorg at 11:34 UTC on Saturday. When the trade couldn’t fill at the sender’s price, THORChain sent back the deposit it thought it held, and it refunded the real one too, leaving a vault 10 ETH short. Nodes saw the reorg, according to THORChain, but the follow-up check that should have thrown the deposit out was still inconclusive when THORChain finalized it.
The shortfall tripped THORChain’s solvency checker, which halted ETH swaps automatically. Node operators cut off outgoing ETH transactions about two minutes later, and a three-node vote then paused every chain to be safe. The sender has since sent the 10 ETH back, THORChain said, closing the shortfall.
A Flaw Now in the Open
THORChain cautioned that after any reorg on an outside chain, “a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.” Core developers are working on fixes, and nodes will turn chains back on once they judge them safe. THORChain gave no date.
The FBI, along with the Secret Service and IRS Criminal Investigation, has separately asked crypto infrastructure providers, THORChain among them, to refuse transactions involving wallets it tied to North Korea’s TraderTraitor group. Binance has put its hot-wallet losses at $6.3 billion. In September, THORChain turned down Bitget’s request to block hacker wallets, and in October Barraford said he would ask its treasury about refunding fees earned on stolen crypto. The network has paused before, including a brief halt in 2023 over a security threat.
Related Listen: Can THORChain Stop North Korea’s Laundering? Its Co-Founder Says It’s Too Decentralized
