THORChain Halts Swaps Across 10 Networks After Ethereum Reorg Exposes Bug
By Abdelaziz Fathi November 2, 2026
Share
Preferred source:
THORChain suspended swaps across 10 blockchain networks after an Ethereum block reorganization triggered an incorrect 10 ETH refund, exposing a vulnerability that could be exploited during future chain reorganizations. The emergency shutdown also temporarily disrupted cryptocurrency transfers linked to the $6.3 billion Binance hack, according to blockchain analytics firm Chainalysis.
The incident began on October 31 at 11:34 UTC, when Ethereum replaced a recently produced block containing a 10 ETH deposit that THORChain had already credited. The protocol subsequently refunded funds that its vault had never received, triggering an automatic solvency alert and a broader suspension of cross-chain trading.
THORChain confirmed that the recipient returned the additional 10 ETH, restoring the affected vault’s balance. However, the underlying vulnerability remained under investigation, with node operators retaining responsibility for determining when affected networks could resume trading.
How Did an Ethereum Reorganization Trigger the Refund Bug?
The problem originated in the interaction between Ethereum’s transaction confirmation process and THORChain’s cross-chain accounting system.
During the one-block reorganization, a deposit that THORChain had already recognized was removed from Ethereum’s accepted transaction history. Because the associated swap failed to satisfy the sender’s price limit, the protocol initiated a refund.
THORChain subsequently paid out 10 ETH even though the corresponding deposit no longer existed on Ethereum’s canonical chain. The sender’s actual funds were also returned, leaving the vault with a 10 ETH shortfall.
The protocol said its nodes detected the reorganization, but the verification process failed to obtain a definitive response before the deposit was finalized internally.
THORChain’s automatic solvency checker identified the discrepancy and halted Ethereum swaps. Within approximately two minutes, node operators stopped signing outbound Ethereum transactions to prevent further funds from leaving the vaults.
Operators then suspended additional chains as a precaution. In its November 1 update, THORChain listed Bitcoin, Ethereum, Solana, Tron, BNB Chain, Bitcoin Cash, Dogecoin, Litecoin, Cosmos and Zcash as halted. Trading remained available on Avalanche, Base, XRP Ledger and THORChain’s native network.
The team warned that the vulnerability could be exploited during future reorganizations on supported blockchains, making a permanent correction necessary before normal operations resume.
Investor Takea