THORChain abruptly suspended trading on ten blockchains following an incident involving an Ethereum block reorganization, which led to a 10 ETH overpayment from one of its vaults. The issue began when an Ethereum reorg at 11:34 UTC on October 31 resulted in a vault paying out 10 ETH for a deposit that never finalized on the canonical chain.
Ethereum reorg leads to vault mismatch
During the brief one-block reorg, a user’s 10 ETH deposit appeared in a block that was later dropped. THORChain’s system observed the deposit and credited it, even though the Ethereum chain did not ultimately confirm the transaction. This discrepancy created a situation where the protocol refunded the unconfirmed deposit, issuing 10 ETH it had not actually received.
The timing of these actions led to a mismatch between THORChain’s ledger and the physical assets held in the vault. As a result, the swap connected to the phantom deposit missed its price limit, triggering a refund process and resulting in the vault having a shortfall of 10 ETH once the refund was executed.
THORChain’s team explained that the reorg caused the protocol to treat a non-existent deposit as real, prompting a refund that paid out 10 ETH from the vault even though the funds had never been received on the canonical chain.
All nodes detected the reorg, but the automated re-check mechanism was unable to resolve the status before the system finalized the transaction. This left the vault insolvent by the amount of the missing deposit.
Automated safeguards and emergency responses
THORChain’s solvency checker quickly identified the imbalance, triggering an automatic halt on ETH swaps. Within approximately two minutes, node operators paused all outgoing ETH transactions to prevent further loss. Three node votes subsequently suspended all ETH outbound activity.
Following this, three more node votes paused operations for all connected chains as an additional precaution, giving core developers time to investigate. The full halt aimed to protect network solvency and provide space for a thorough review of the event and its underlying causes.
Subsequently, the user involved returned the 10 ETH, restoring the vault’s solvency. THORChain clarified that emergency halts require three node votes, but can be reversed or re-implemented with further consensus.
The development team noted that while a halt can be triggered by three node votes, this process does not give those nodes special control over network assets.
Trading status across networks
Trading currently remains active on AVAX, BASE, RUNE, and XRPL, while ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, and ZEC are halted. Nodes will re-enable these chains only after the necessary security checks and fixes are completed.
Developers warned of additional risks if an external chain experiences a reorg, as attackers may exploit duplicated transactions with the same nonce, potentially resulting in further fraudulent payouts. Work is ongoing to strengthen protections against such scenarios.
For market participants tracking the resumption of halted chains and monitoring vault solvency in fast-moving situations like this, CryptoAppsy’s real-time news monitoring and smart price alerts offer effective tools. Users can receive instant updates on which blockchains are being reactivated and customize alerts to follow specific assets affected by incidents such as network halts or protocol refunds.
