THORChain Services suspended due to an Ethereum reorganization, inadvertently disrupting the Binance hackers’ money-laundering process

AT A GLANCE

An Ethereum reorganization caused THORChain duplicate refunds and suspended cross-chain swaps, delaying the transfer of the relevant stolen funds.

Article

BlockBeats News,November 1, Chainalysis stated that THORChain recently inadvertently delayed the laundering of funds stolen in the Binance attack due to an Ethereum chain reorganization. The reorganization caused THORChain to mistakenly issue a duplicate refund to a user who deposited 10 ETH, triggering an emergency protocol suspension that temporarily prevented all users from conducting cross-chain swaps, including money launderers associated with North Korean hacking groups.

Chainalysis said that, before THORChain resumes services, neither the attackers nor other users can conduct swaps through most of its cross-chain bridges.

Previously, the Federal Bureau of Investigation (FBI), the Secret Service (USSS), and the Internal Revenue Service Criminal Investigation (IRS-CI) jointly called on THORNode operators,RPC node operators, instant exchange platforms, DeFi service providers, and other virtual asset service providers to block transactions involving addresses associated with Binance hackers, as well as fund flows derived from those addresses. The announcement also disclosed wallet addresses directly or closely associated with the relevant North Korean hacking activity.

Original link https://m.theblockbeats.info/flash/374838

Key points

Chainalysis stated that THORChain an Ethereum chain reorganization recently inadvertently delayed the laundering of funds stolen in the Binance attack.
The chain reorganization caused THORChain to mistakenly issue a duplicate refund to a user who deposited 10 ETH, triggering an emergency protocol suspension.
During the suspension, all users were temporarily unable to conduct cross-chain swaps, including money launderers associated with North Korean hacking groups.
FBI、USSS and IRS-CI previously called on relevant virtual asset service providers to block transactions involving addresses associated with Binance hackers and addresses derived from them.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

A cross-chain swap is the operation of exchanging a blockchain asset for one on another chain. This Ethereum chain reorganization caused THORChain duplicate refunds, leading the protocol to suspend services and temporarily prevent cross-chain fund transfers.

Why it matters to readers

The incident shows that blockchain reorganizations may disrupt the settlement of cross-chain protocols and temporarily affect related fund flows.

This is not a report on changes in ordinary users’ asset prices, but rather an incident involving a cross-chain service suspension and security interception.

Risks and unknowns

The original announcement and on-chain transaction details were not provided in the evidence.
THORChain The evidence does not specify when cross-chain swap services will resume.
The evidence does not specify whether the stolen funds were frozen, recovered, or continue to be transferred.

THORChain Services suspended due to an Ethereum reorganization, inadvertently disrupting the Binance hackers’ money-laundering process

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center