THORChain Temporarily Suspends Service Due to Ethereum Block Reorganization, Accidentally Blocking North Korean Hackers' Laundering of Binance Stolen Funds

on November 1, according to blockchain analysis firm Chainalysis, THORChain triggered an emergency pause due to an anomalous refund issue caused by an Ethereum block reorg (Reorg), unexpectedly delaying the North Korean hackers' efforts to launder Binance stolen funds through the protocol.

Chainalysis stated that earlier that day, an Ethereum block reorg occurred, causing THORChain to erroneously execute a double refund to a user who deposited 10 ETH. This anomaly triggered the protocol's emergency pause, temporarily preventing all users, including the North Korean hackers, from accessing the related cross-chain swap services.

Before THORChain resumed operations, neither the hackers nor other users could complete asset swaps through most of its cross-chain bridges, temporarily halting the laundering process for some of the stolen Binance funds.