Refund

TRON

Chains

THORChain

Ethereum

<img width="1920" height="1080" src="https://blockchainreporter.net/wp-content/uploads/2025/04/blockchain46.webp" alt="Blockchain main2" style="float: right; margin-left: 5px;" title="THORChain Halts Trading on 10 Chains After an Ethereum Reorg Triggers a 10 ETH Double Refund 6">
<p>RUNE is down 11.4% to $0.542, and the number that explains it is 10 ETH. On October 31, a one-block Ethereum reorg caused THORChain to pay out 10 ETH that a vault never received. The protocol’s automatic solvency checker caught the shortfall and halted ETH swaps, and node operators then froze trading on ten chains while core developers investigated. THORChain published the full breakdown on November 1, confirming the missing 10 ETH has been returned and the vault is solvent again. The disclosure makes one thing explicit that traders are only now pricing in: every time an external chain reorgs, a malicious actor could be paid funds by the THORChain vaults, and the network has to halt first and patch second.</p>
<blockquote class="twitter-tweet">
 <p>On October 31, THORChain halted trading on several blockchains. An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators halted ETH transaction signing, so no further ETH could leave the vaults. Node operators then halted all chains as a precaution so core developers could investigate. The 10 ETH has been returned by the user to make the vault solvent again.</p>
 <p>— THORChain (@THORChain) <a href="https://x.com/THORChain/status/2117011632757092501" rel="noopener noreferrer nofollow">November 1, 2026</a></p>
</blockquote>
<h2 id="the-one-block-reorg-that-broke-the-deposit-ledger">The One-Block Reorg That Broke the Deposit Ledger</h2>
<p>At 11:34 UTC on October 31, Ethereum reorganized a single block. A 10 ETH deposit destined for one of THORChain’s vaults sat inside the dropped block and never landed on the canonical chain. THORChain’s observers had already seen and credited the deposit, so when the associated swap missed its price limit and was refunded, the vault paid out 10 ETH it had never actually received. The sender’s real deposit was refunded as well, which is how one reorg turned into two outbound payments on the same collateral.</p>
<p>Every node detected the reorg, per THORChain’s account. The re-check that should have removed the ghost deposit could not return a clear answer in time, so it was finalized as if real. The failure was not in spotting the reorg but in the race between the observation layer and the settlement layer, a gap the protocol is now closing.</p>
<h2 id="how-the-solvency-checker-contained-it-in-two-minutes">How the Solvency Checker Contained It in Two Minutes</h2>
<p>The containment was automatic. THORChain said the solvency checker flagged the shortfall and halted ETH swapping on its own, then three node votes stopped all ETH outbound payments, and three more votes halted every chain as a precaution. The exchange listed ten blockchains as halted — ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC — while four kept trading: AVAX, BASE, RUNE and XRPL. That is the narrow edge where the incident stays a 10 ETH loss instead of a run on the vaults.</p>
<p>The recovery of the 10 ETH is the detail that separates this from a solvency event. THORChain confirmed the user returned the funds, writing that the vault is solvent again. It is a reminder of how much of the earlier <a href="https://blockchainreporter.net/tether-thorchain-tron-vault-freeze/" rel="noopener noreferrer nofollow">Tether TRON vault freeze</a> was also about the protocol proving it could rebalance under stress rather than absorbing the loss.</p>
<h2 id="the-laundering-pause-no-one-planned">The Laundering Pause No One Planned</h2>
<p>Chainalysis added the twist that pulled this into the Binance hack story. In an <a href="https://x.com/chainalysis/status/2116585208950542815" rel="noopener noreferrer nofollow">October 31 post</a>, the analytics firm wrote that THORChain “inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” because the emergency pause blocked cross-chain swaps for every user, including the North Korea-linked actors moving the stolen assets. It was not a deliberate intervention. The halt was triggered by the reorg and the double refund, and the laundering slowdown was a side effect of the same pipes being closed to everyone.</p>
<p>The distinction matters for how the market reads the story. A protocol that intentionally freezes a specific adversary is a compliance story. A protocol that halts globally to protect solvency and happens to block everyone equally is an infrastructure story, and the RUNE reaction is priced against the latter.</p>
<h2 id="why-rune-slid-11-and-what-the-vault-tells-traders">Why RUNE Slid 11% and What the Vault Tells Traders</h2>
<p>RUNE traded at $0.542 on Binance, down 11.4% over 24 hours, while Bitcoin and Ether were roughly flat at $78,080 and $2,271 respectively. The move is the market repricing reorg risk, not solvency risk. At the November 1 spot price, the erroneous 10 ETH payout was worth about $22,710, an amount that was already returned by the time the disclosure landed, so the balance-sheet impact is zero.</p>
<p>The price damage is forward-looking. THORChain stated plainly that now that the reorg vector is public, “every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults.” Until the core-developer fix ships, the protocol is trading on the speed of its node votes, which is exactly the kind of conditional risk that widens a discount in a token whose value is tied to vault throughput.</p>
<h2 id="the-fix-and-the-risk-it-exposes">The Fix and the Risk It Exposes</h2>
<p>Core developers are working on the necessary fixes, and THORChain said nodes will decide when to re-enable each halted chain as they are deemed safe. The announcement also walked through the governance mechanics: three node votes can trigger an emergency halt, four counter votes can reverse it, five can reverse the reversal, and so on. Halting a chain does not hand control of the assets to those nodes. That design is why the incident stayed contained, and it is also why recovery is not instant.</p>
<p>THORChain has been through this loop before. The DEX spent weeks <a href="https://blockchainreporter.net/thorchain-dex-resumes-operations-38-days-after-vault-exploit/" rel="noopener noreferrer nofollow">rebuilding after a $10 million vault exploit</a> earlier this year, and the pattern is consistent: halt, prove solvency, patch, then reopen chains one vote at a time. The open question is whether the patch closes the nonce-replay vector across every external chain or only Ethereum, because a partial fix would leave the same payout bug reachable through a different network. Nodes will answer that by how selectively they re-enable chains over the next few days.</p>
<p>The episode is a sharper version of a problem every cross-chain bridge has to solve: an observer can only act on what it has seen, and a reorg quietly rewrites what it saw. For THORChain, the cost of that rewrite was one 10 ETH payout it could claw back, a multi-chain halt, and an 11% markdown in RUNE. For a larger bridge holding deeper liquidity, the same race between observation and settlement could be measured in nine figures. That is why the market is repricing the whole category, not just this vault.</p>
<div class="disclaimer">
 <p>Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.</p>
</div>

THORChain Halts Trading on 10 Chains After an Ethereum Reorg Triggers a 10 ETH Double Refund

Table of Contents

BlockchainReporter

Other articles published on Nov 2, 2026

Join our free newsletter for daily crypto updates!