Ethereum Reorganization Triggers THORChain Pause, Delaying Laundering Route

THORChain halted swaps across most of its cross-chain bridges after an Ethereum reorganization caused it to refund a user's 10 Ether (ETH) deposit twice. The emergency pause temporarily prevented all users from exchanging assets through most of those bridges, extending the disruption beyond the account that received the duplicate payment.

Chainalysis linked the affected route to North Korean hackers laundering a large amount of funds stolen from Binance. It said the pause delayed that activity by interrupting access to THORChain's cross-chain swaps. The service suspension thus had two effects: it followed a refund error tied to one 10 ETH deposit and disrupted a route associated with the movement of stolen funds.

The incident began with a change to Ethereum's chain history, then led to a separate protocol-level response at THORChain. Most of the protocol's bridge-based exchange activity was unavailable to users for a period, and that same interruption unexpectedly slowed the laundering process identified by Chainalysis.