THORChain halted trading across ten connected blockchain networks after a one-block Ethereum reorganization caused its vault system to refund 10 ETH that it had never received on Ethereum's final chain. The protocol disclosed the sequence on November 1, one day after the incident began. The user later returned the 10 ETH, restoring the affected vault's solvency, but the episode exposed a settlement weakness that THORChain said could be repeated during future external-chain reorganizations.

A dropped Ethereum block created two refunds

According to THORChain's incident account, Ethereum reorganized one block at 11:34 UTC on October 31. A 10 ETH deposit appeared in the displaced block and was observed by THORChain, but it did not remain on Ethereum's canonical chain. The planned swap then missed its price limit. THORChain refunded the credited deposit from its own vault, while the sender's actual transaction was also refunded after the reorganization. The result was an extra 10 ETH payment from the vault.

Related reporting: FBI Attributes $6 Billion Binance Theft to North Korea

Automated checks contained the shortfall

THORChain said every node detected the reorganization, but the follow-up check that should have removed the deposit could not obtain a clear answer before the observation was finalized. Its automated solvency checker identified the resulting shortfall and stopped Ether swaps. Within roughly two minutes, node operators also halted Ethereum transaction signing, preventing further ETH from leaving protocol vaults. Operators then paused other connected chains while core developers investigated the broader impact.

Ten networks were listed as halted

The protocol's disclosure listed ATOM, Bitcoin Cash, BNB Smart Chain, Bitcoin, Dogecoin, Ethereum, Litecoin, Solana, Tron and Zcash as halted at that stage. Trading remained available on Avalanche, Base, THORChain's native RUNE network and the XRP Ledger. Cointelegraph independently reported the multi-chain pause and the 10 ETH refund mechanics. THORChain's live explorer later labeled the network degraded and showed several services restored while individual scanning, trading or signing functions remained paused, illustrating that recovery was proceeding chain by chain. These controls apply to THORChain's handling of the connected assets, not to the operation of Bitcoin, Ethereum or the other underlying blockchains themselves. Users could therefore see a network running normally while its THORChain swap route remained unavailable.

The risk extends beyond one small loss

The direct shortfall was limited and has been repaid, but the technical concern is larger than 10 ETH. THORChain warned that once the mechanism was public, a malicious user could try to exploit a future external-chain reorganization by submitting a replacement transaction with the same nonce after the protocol had credited the original. Cross-chain systems must make decisions about events on separate networks that reach practical finality at different speeds. A temporary mismatch can therefore create a real payout even when the originating deposit disappears.

Full normalization depends on a verified fix

THORChain's documentation distinguishes between trading halts, signing halts and full chain halts, each carrying different consequences for swaps, scanning and outbound transactions. It advises interfaces to monitor the protocol's halt flags and prevent unsupported actions while a chain is paused. The protocol said core developers were preparing fixes and that node operators would decide when each chain was safe to re-enable. Until those changes are deployed and services are fully restored, users and integrators should verify live chain status rather than assume that the returned funds ended the operational risk.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.