Key Highlights:
- THORChain halted ETH swaps after an Ethereum block reorganisation caused its vault to pay out 10 ETH that it had not received.
- The 10 ETH has been returned, restoring the vault’s balance, while developers work on fixes before affected chains resume trading.
- Approximately $242 million linked to the recent $628 million Binance hack reportedly moved through THORChain, adding scrutiny to the protocol as RUNE fell 18%–20%.
THORChain halted trading on multiple major blockchains on October 31 after an Ethereum block reorganization caused its network to pay out 10 ETH that had not reached one of its vaults. The protocol’s automatic solvency checker detected the resulting shortfall and paused ETH swaps, prompting node operators to halt extra transactions across other supported chains as a precaution.
The incident also drew attention to THORChain’s role in the movement of funds stolen during the recent $628 million Binance hack. The attacker had moved approximately $242 million through THORChain after Tether froze USDT associated with the theft. The 10 ETH involved in the solvency incident has since been returned, restoring the vault’s balance, while developers work on fixes before trading resumes across affected networks.
Why Did THORChain Halt Trading Across Multiple Blockchains?
The incident began at 11:34 UTC on October 31, when Ethereum experienced a one-block reorganisation. A 10 ETH deposit intended for a THORChain vault appeared in a block that was subsequently dropped and therefore never became part of the canonical blockchain. However, THORChain had already observed and credited the deposit. When a swap failed to meet its price limit, the protocol refunded the transaction but paid out 10 ETH from the vault, despite the original deposit never arriving on the canonical chain.
The sender also received a refund of the original deposit. Although every THORChain node detected the reorganization, the simultaneous verification process that should have removed the credited deposit could not obtain a clear answer in time. As a result, the deposit was finalized in the protocol’s accounting system, creating a difference between the vault’s recorded balance and its actual holdings.
The automatic solvency checker identified the shortcomings and halted ETH swaps. Within approximately two minutes, node operators also stopped ETH transaction signing, preventing further ETH from leaving the vaults. Operators subsequently voted to halt activity across all supported chains as a precaution while core developers investigated the incident. Now that the mechanism is publicly understood, an attacker could potentially exploit a similar reorganisation by submitting a new transaction with the same nonce.
If the protocol incorrectly credits a deposit that does not become part of the canonical chain, its vaults could potentially release funds without receiving the corresponding assets. THORChain’s emergency halt mechanism allows three node votes to trigger a network or chain-level pause to protect solvency. The decision can be reversed through four countervotes, while five votes can reverse that decision again. This voting structure is intended to balance decentralised governance with the ability to respond quickly to security threats.
Which Blockchains Remain Operational as THORChain Developers Work on Fixes?
Following the sudden halt, THORChain divided its supported networks into those that remain available for trading and those that have been paused. The following blockchains remain operational:
On October 31, THORChain halted trading on several blockchains.
An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators halted ETH transaction signing, so no further ETH could leave the vaults.
Node operators then halted all chains as a precaution so core developers could investigate.
The 10 ETH has been returned by the user to make the vault solvent again.
Breakdown of what happened and next steps:
At 11:34 UTC Oct 31, Ethereum had a one-block reorg. A 10 ETH deposit to one of the vaults sat in the dropped block and never landed on the canonical chain.
THORChain had already observed and credited that deposit. The swap missed its price limit and was refunded, so the vault paid out 10 ETH it never received. The sender’s real deposit was refunded as well.
Every node detected the reorg. But the re-check that should have removed the deposit could not get a clear answer in time, so it was finalized.
The solvency checker halted ETH swapping automatically, then three node votes halted all ETH outbound payments.
All chains were then halted by three node votes as a precaution. Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.
Note: Three node votes can trigger emergency halts to protect network solvency. However, that action can be reversed by four counter node votes, then five node votes can reverse the reversal, and so on, maintaining a balance between decentralization and rapid emergency intervention. Halting a chain does not give those nodes control of the assets.
Core developers have been working on the necessary fixes.
Nodes will decide to re-enable chains as they are deemed safe.
Trading blockchains: AVAX, BASE, RUNE, XRPL
Halted blockchains: ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC
— THORChain (@THORChain) November 1, 2026
- Avalanche ( AVAX)
- Base
- RUNE
- XRP Ledger
Trading has been halted on:
- Cosmos ( ATOM)
- Bitcoin Cash (BCH)
- Bitcoin (BTC)
- Dogecoin ( DOGE)
- Ethereum ( ETH)
- Litecoin ( LTC)
- Solana ( SOL)
- Tron ( TRON)
- Zcash ( ZEC)
Core developers are working on the necessary fixes, but the decision to restore activity will rest with node operators. Chains will be re-enabled once operators consider them safe to resume transactions. The incident has attracted additional attention because of THORChain’s connection to the movement of funds stolen in the recent Binance security breach. On-chain data indicated that approximately $242 million of the stolen funds moved through THORChain after Tether froze USDT associated with the broader theft.
The ambiguity surrounding the incident and the temporary trading constraints also affected THORChain’s native RUNE token. The token allegedly plunged by around 18% to 20% amid concerns about the network’s exposure and the disruption to trading activity.
The immediate priority for THORChain is to address the reorganization-related accounting issue and restore confidence in its solvency guardrails. The network’s return to normal operations will rely on the completion of those fixes and node operator’s evaluation of the affected chains.
