THORChain, a decentralized cross-chain liquidity protocol, suspended swaps across ten major blockchain networks after an Ethereum block reorganization led to a 10 ETH refund error. This incident caused the native token RUNE to drop approximately 18% as traders reacted to the sudden halt and market uncertainty.
Ethereum Block Reorganization Triggers Swap Suspension
On October 31, at around 11:34 UTC, Ethereum underwent a one-block reorganization—an uncommon event where a valid block is replaced by an alternative version, altering the transaction history. A 10 ETH deposit intended for a THORChain vault appeared in the block that was ultimately discarded.
THORChain had already recognized the deposit in its records, but the transaction vanished from Ethereum’s accepted blockchain. When the deposit’s corresponding swap failed to achieve its price limit, the protocol issued a refund despite its vault never having received the funds.
THORChain’s automated solvency checker detected this resulting 10 ETH deficit and promptly halted Ethereum swaps. Node operators moved quickly, suspending outgoing Ethereum transactions within two minutes, and paused additional networks as the vulnerability was assessed.
Impacted networks included Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash. However, swaps on Avalanche, Base and XRP Ledger, as well as on the THORChain network itself, remained available.
THORChain later received the returned 10 ETH from the recipient, correcting the vault balance. Still, the underlying risk persists since similar blockchain reorganizations could trigger further improper refunds on other supported networks.
Mini dictionary: Block reorganization (reorg): A blockchain event where a previously accepted block is replaced by a different block, causing changes in the transaction history. This can result in the disappearance or duplication of transactions, creating vulnerabilities for protocols relying on accurate record-keeping.
| Network | Status After Incident |
|---|---|
| Ethereum, Bitcoin, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin, Zcash | Swaps Suspended |
| Avalanche, Base, XRP Ledger, THORChain Network | Swaps Active |
Security Incident Overlaps with Binance Hack Investigation
The suspension occurred as blockchain investigators continued to track cryptocurrency stolen during the October 29 Binance security breach. Chainalysis, a blockchain analytics provider, reported that the THORChain shutdown delayed efforts to transfer stolen funds using the protocol’s cross-chain swapping services.
Previous attributions from the FBI linked the Binance attack to the North Korean hacking group known as TraderTraitor. The group is suspected to use decentralized exchanges and cross-chain infrastructure to obscure the movement of stolen digital assets.
Blockchain analytics company Chainalysis noted delays in the movement of stolen crypto assets due to the THORChain suspension, temporarily complicating the efforts of hackers to transfer funds across networks.
THORChain’s ability to process native asset swaps across multiple blockchains typically serves users seeking decentralized trading without relying on centralized platforms. However, this same flexibility can complicate law enforcement’s ability to trace these assets once moved across chains.
Coinpaper previously reported that over 233 million XRP was shifted in the early stages of the Binance incident. Investigators have been monitoring movements related to these assets, especially those involving Ethereum balances.
The protocol’s temporary shutdown was automated by its security systems, not a targeted move to hinder the transfer of assets related to the Binance breach. Nonetheless, the event highlights how technical failures can disrupt both legitimate and illicit crypto transactions alike.
RUNE Declines 18% as Developers Address Protocol Vulnerability
After the trading halt, RUNE fell sharply by about 18%, dipping toward $0.52 on November 2. This drop aligned with a broader downturn affecting the wider crypto sector following the Binance security incident.
The technical problem has introduced fresh uncertainties for traders; THORChain’s activity relies on seamless and secure interactions between independent blockchains. Developers are now implementing new safeguards intended to prevent the recognition of deposits from blocks that do not ultimately remain in a network’s accepted transaction history.
Node operators will determine when it is safe to resume swaps on each suspended network. The event reemphasizes broader concerns within the industry about digital asset security—including transaction validation and the considerable challenges associated with recovering funds that move between multiple blockchains.
The incident illustrates how systems designed to ensure security, such as automated solvency checkers, can rapidly intervene in response to blockchain anomalies, but also disrupt normal trading activity across a wide range of networks.
