THORChain Warns Reorg Flaw Could Trigger Repeat Vault Payouts

In a Nov. 1 warning, THORChain said the incident revealed a refund weakness that could let someone use a replacement transaction with the same nonce to collect funds from vaults on another chain.

At 7:34 a.m. ET (11:34 UTC) on Oct. 31, Ethereum’s history shifted back one block, removing a deposit THORChain had already recorded. The swap missed its price limit. THORChain refunded the failed swap and also returned the sender’s original deposit, leaving a vault 10 ETH short.

An automatic solvency checker halted ETH swaps. Within about two minutes, node operators stopped signing ETH transactions, then paused all chains as a precaution. The user returned the 10 ETH, restoring the vault’s solvency, while developers worked on fixes.

In its Nov. 1 update, THORChain listed 10 networks as halted, with Avalanche, Base, RUNE and XRP Ledger listed as trading. Node operators would decide when each network was safe to re-enable. The pause affected THORChain swap routes, not the operation of the underlying blockchains.

THORChain’s protocol team warned: “A malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.”

Chainalysis said the pause delayed laundering of a significant amount of funds stolen from Binance and prevented users, including North Korean money launderers, from swapping through most THORChain bridges.