THORChain Halts Ten Chains After 10 ETH Reorg Overpayment

THORChain suspended trading across ten blockchains after a one-block Ethereum reorganization on October 31 caused one of its vaults to send out 10 ETH it had never actually received, Blockonomi reported. The protocol’s automatic solvency checker caught the shortfall and stopped ETH swaps on its own, and node operators paused transaction signing roughly two minutes later.

The reorg struck at 11:34 UTC and lasted a single block. A 10 ETH deposit bound for a THORChain vault had been credited by the protocol’s observers before the block was dropped from the canonical chain. THORChain described the sequence in a post on X dated November 1, writing that the reorg caused the protocol to pay out 10 ETH a vault never received.

Key facts

• The Ethereum reorg occurred at 11:34 UTC on October 31 and spanned one block.
• The solvency checker halted ETH swaps automatically; node operators stopped ETH signing within about two minutes.
• Three node votes halted all ETH outbound payments, and three more votes halted every chain as a precaution.
• Trading remains active on AVAX, BASE, RUNE and XRPL, while ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC are halted.
• According to Blockchain Reporter, RUNE traded at $0.542 on Binance, down 11.4% over 24 hours, while Bitcoin and Ether were roughly flat at $78,080 and $2,271.

How one dropped block produced two payouts

The deposit credited to the vault sat inside the discarded block and never reached the canonical chain. Because THORChain had already observed and credited it, the swap linked to that deposit went through, missed its price limit and was refunded. The vault therefore sent out 10 ETH it had not received, and the sender’s genuine deposit was refunded as well, producing two outbound payments against the same collateral.

Every node detected the reorg. The re-check that should have removed the ghost deposit could not return a clear answer in time, so the system finalized it. The gap between what the observation layer saw and what the settlement layer confirmed is the failure THORChain says it is closing.

THORChain also set out the governance mechanics behind the halt: three node votes can trigger an emergency stop to protect solvency, four counter votes can reverse it, and five can reverse that reversal. The team stated that halting a chain does not give those nodes control of the assets.

Laundering pause was a side effect

Blockchain Reporter noted an unintended consequence: Chainalysis wrote in an October 31 post that THORChain inadvertently delayed laundering of a significant amount of funds stolen from Binance, because the emergency pause blocked cross-chain swaps for every user, including North Korea-linked actors moving the stolen assets. The halt was triggered by the reorg and the double refund, not by any deliberate intervention.

The market reaction reflected that reading, per Blockchain Reporter, which framed the RUNE slide as a repricing of reorg risk rather than solvency risk. The erroneous payout was worth about $22,710 at the November 1 spot price and had already been returned by the time the disclosure landed, so the balance-sheet impact was nil.

Why it matters

The incident shows how an observer-based bridge can be rewritten by events on the chain it watches: THORChain acted on a deposit that a reorg erased. Contained, the cost was a returned payout, a multi-chain freeze and a double-digit token markdown. THORChain has been through a comparable cycle before, after a $10 million vault exploit earlier this year, and the same sequence applied — halt, prove solvency, patch, reopen.

THORChain acknowledged that now the vector is public, a malicious actor could submit a transaction with the same nonce during a reorg on an external chain and be paid by the vaults. That makes the pending fix a security question, not just an operational one, for users and liquidity providers across the halted chains.

What to watch

Core developers are working on the fixes, and nodes will decide when to re-enable each chain once they judge it safe. How selectively they reopen chains will indicate whether the patch covers the nonce-replay risk on every external network or only Ethereum.

The figures above describe market moves, not forecasts. This is not financial advice, and crypto markets are volatile and uncertain.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: Blockonomi, Blockchain Reporter