THORChain Mistakenly Refunds 10 ETH, Disrupting Binance Hackers’ Transfers

THORChain has shut down cryptocurrency exchanges on 10 blockchain networks following an error in an Ethereum transaction, which has resulted in the temporary halt of exchanges connected to the $6.3 billion (roughly Rs. 59,667 crore) Binance hack. The cross-chain network, according to a statement issued on November 2, experienced a problem where the refund process failed after there was a reorganisation of the Ethereum blockchain on October 31. The network's security mechanisms detected a lack of 10 ETH payments and stopped all Ethereum swap transactions prior to traders halting trading on other networks. 

Ethereum Reorganisation Triggers Emergency Halt Across THORChain Networks

The blockchain analysis firm Chainalysis claimed that the disruption blocked access to most of THORChain's cross-chain facilities by users. The incident occurred at 11:34 UTC on October 31 during a one-block reorganisation of Ethereum, removing a recently added transaction from its blockchain history. The relevant transaction was a 10 ETH transfer that should have been sent to a THORChain vault. Though Ethereum cancelled the deposit transaction, THORChain had already received the deposit. The relevant swap did not comply with the set price limit. Therefore, the protocol needed to give a refund.

However, since the initial deposit was not registered on the Ethereum chain, THORChain paid out 10 ETH from the vault that did not receive the initial deposit. Separately, the initial deposit of the depositor was returned in full, leading to another withdrawal of 10 ETH. THORChain confirmed that the automatic balance sheet system noticed the discrepancy and paused the swaps on the Ethereum chain instantly. Just two minutes after detecting the vulnerability, node operators stopped signing for new transactions.

The team then stopped other interconnected networks as the developers worked on the issue. As per the protocol, the beneficiary returned the additional 10 ETH to restore the balance in the vault. The emergency impacted the swaps for Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin, and Zcash. Trading is still possible through Avalanche, Base, and XRP Ledger, along with the native THORChain network. The network dashboard of the protocol shows the working status of the supported blockchains.

The halt in trading was due to ongoing investigations by the blockchain firm into the theft of funds from Binance following its hack on October 29. According to Chainalysis, the technical issue was responsible for causing a delay in the transfer of funds connected to the hack. The firm revealed that the emergency halt prevented both legitimate and suspicious users from accessing the majority of THORChain's cross-chain swaps.