Refund

Chains

THORChain

Sender

<div style="border: 1px solid rgba(128,128,128,0.35); border-left: 5px solid #f0b90b; border-radius: 6px; padding: 16px 18px; margin: 22px 0;">
 <p style="margin: 0 0 10px; font-weight: bold; text-transform: uppercase; letter-spacing: 0.05em; font-size: 0.9em;">Key Takeaways</p>
 <ul style="margin: 0; padding-left: 20px;">
  <li style="margin-bottom: 6px;">One-block Ethereum reorg at 11:34 UTC, October 31</li>
  <li style="margin-bottom: 6px;">Sender returned the extra 10 ETH payout</li>
  <li style="margin-bottom: 6px;">ETH signing halted within about two minutes</li>
  <li>Ten chains halted, four trading on November 1</li>
 </ul>
</div>
<p>THORChain set out the sequence in a <a href="https://x.com/THORChain/status/2117011632757092501" rel="noopener noreferrer nofollow">post on X</a> on November 1, saying the user had returned the extra 10 ETH and that core developers were working on the necessary changes.</p>
<h2 id="what-the-reorg-removed">What the reorg removed</h2>
<p>At 11:34 UTC on October 31, Ethereum replaced one recent block with a competing version. The discarded block contained a 10 ETH deposit to a THORChain vault, which the protocol’s observers had already seen and credited.</p>
<p>Blocks that recent are still open to replacement. Ethereum treats a block as <a href="https://ethereum.org/developers/docs/consensus-mechanisms/pos/faqs" rel="noopener noreferrer nofollow">finalized</a> only after about two epochs, roughly 13 minutes, and nothing in THORChain’s account suggests finalized history changed. The failure happened inside THORChain, which acted on a deposit before Ethereum had settled it.</p>
<p>Two payments followed. The swap attached to the credited deposit missed its price limit, so THORChain refunded 10 ETH. The sender’s deposit on Ethereum’s accepted chain was then refunded as well. One 10 ETH deposit reached the vault, and 20 ETH left it.</p>
<p>THORChain’s own warning shows how one deposit could be counted twice. Every Ethereum account numbers its transactions with a nonce. Once the original transfer vanished with its block, that nonce could be used again on the accepted chain. THORChain wrote that during any external reorg, “a malicious actor could perform a new transaction with the same nonce” and be paid from its vaults.</p>
<h2 id="every-node-saw-the-reorg-the-refund-went-out-anyway">Every node saw the reorg. The refund went out anyway.</h2>
<p>Detection was not the problem. According to THORChain, every node registered the reorg, but the automated re-check meant to settle the deposit’s status could not finish before THORChain finalized the observation on its own chain. The <a href="https://dev.thorchain.org/bifrost/how-bifrost-works.html" rel="noopener noreferrer nofollow">Bifrost documentation</a> describes how observations are reversed when an external transaction disappears. On October 31, that reversal did not happen before the refund was paid.</p>
<p>The post does not say why the re-check ran out of time or what the fix will change. Repayment covered this payout only because the recipient chose to return it. As THORChain described the flaw, it pays whoever triggers it, and someone timing transactions around a future reorg would have no reason to send anything back.</p>
<h2 id="why-a-10-eth-flaw-froze-ten-chains">Why a 10 ETH flaw froze ten chains</h2>
<p>THORChain’s automatic solvency checker spotted the shortfall and halted ETH swaps. Within about two minutes, <a rel="noopener noreferrer nofollow">node</a> operators also stopped ETH transaction signing, which blocks payouts from the vaults. They then halted trading on other chains as a precaution, because the nonce warning covers reorgs on any connected chain, not only Ethereum.</p>
<div style="margin: 24px 0;">
 <p style="margin: 0 0 12px; font-weight: bold;">Where THORChain’s services stood</p>
 <div style="display: grid; grid-template-columns: repeat(auto-fit, minmax(210px, 1fr)); gap: 12px;">
  <div style="border: 1px solid rgba(128,128,128,0.35); border-top: 4px solid #e5534b; border-radius: 8px; padding: 14px;">
   <p style="margin: 0 0 6px; font-weight: bold;">Trading halted</p>
   <p style="margin: 0; font-size: 0.95em;">ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC</p>
  </div>
  <div style="border: 1px solid rgba(128,128,128,0.35); border-top: 4px solid #3fb950; border-radius: 8px; padding: 14px;">
   <p style="margin: 0 0 6px; font-weight: bold;">Trading active</p>
   <p style="margin: 0; font-size: 0.95em;">AVAX, BASE, RUNE, XRPL</p>
  </div>
  <div style="border: 1px solid rgba(128,128,128,0.35); border-top: 4px solid #58a6ff; border-radius: 8px; padding: 14px;">
   <p style="margin: 0 0 6px; font-weight: bold;">Outbound payments</p>
   <p style="margin: 0; font-size: 0.95em;">Status data from October 31 showed signing still enabled on most halted chains, so pending payouts could leave while new swaps stayed blocked.</p>
  </div>
 </div>
 <p style="margin: 10px 0 0; font-size: 0.85em; opacity: 0.75;">Trading status per THORChain’s November 1 post; signing status per THORChain’s status API as reported on October 31.</p>
</div>
<p>The list has already shifted once. On the evening of October 31, <a href="https://thedefiant.io/news/defi/thorchain-swaps-remain-paused-on-12-chains-after-reported-refund-error" rel="noopener noreferrer nofollow">The Defiant</a> reported that THORChain’s status API showed trading paused on 12 of 13 external chains. By the November 1 post, three of them had been re-enabled. THORChain did not say why those three went first.</p>
<p>None of this stops the underlying networks. Bitcoin, Ethereum and the other chains keep producing blocks; the halts only limit what THORChain will process for each one.</p>
<p>Read one way, the incident shows the safeguards working. The checker fired without human input, payouts stopped within minutes, and the exposure stayed at 10 ETH. In May, the same check had to halt trading and signing after an exploit drained about $10.7 million from a vault. What the checker cannot do is repair the observation logic, which is why the halts widened instead of easing once the vault was whole again.</p>
<h2 id="three-votes-to-stop-four-to-overrule">Three votes to stop, four to overrule</h2>
<p>Halts like these are operational settings, and THORChain’s <a href="https://docs.thorchain.org/technical-documentation/technical-deep-dive/governance" rel="noopener noreferrer nofollow">governance documentation</a> lets a small group of nodes change them. A setting needs at least three active-node votes and must outpoll every competing value; a tie leaves the current setting in place.</p>
<p>That threshold has been tested in public before. During the February 2025 laundering of funds stolen from Bybit, three validators voted to halt ETH trading, and other node operators reversed the vote almost immediately. THORChain’s November 1 account also notes that halting a chain does not hand nodes control of vault assets. Stopping activity and signing transfers are separate powers.</p>
<div class="read-more pb-3 pt-3 pt-md-2 px-3 my-4 border bg-light">
 <h5 class="text-uppercase border-bottom mb-3 pb-1 d-none d-md-block">READ MORE:</h5><a href="https://coindoo.com/ethereum-price-holds-major-floor-bulls-fight-back/" rel="noopener noreferrer nofollow">
  <div class="contentRight col-4"><span><img src="https://coindoo.com/wp-content/uploads/2026/05/ethereum-eth-logo-p.jpg"></span>
  </div>
  <div class="contentLeft col-8">
   <h4 class="title mb-0">Ethereum Price Holds Major Floor as Bulls Fight Back</h4>
  </div></a>
</div>
<h2 id="a-halt-thorchain-would-not-use-against-launderers">A halt THORChain would not use against launderers</h2>
<p>On September 28, facing calls to freeze funds from the Bitget hack, THORChain wrote on X that a network halt is an emergency security measure meant to protect the protocol, and declined to use one against those funds. The reorg flaw is exactly that kind of emergency, and the halt it triggered caught the launderers anyway.</p>
<p>Chainalysis, which <a href="https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/" rel="noopener noreferrer nofollow">attributes the $6.4 billion Binance theft</a> to North Korea’s TraderTraitor group, said on November 1 that THORChain had “inadvertently delayed the laundering of a significant amount of funds stolen from Binance.” The delay came from the same feature that frustrates ordinary users: a halted chain processes nobody’s swaps. Coindoo’s coverage of <a href="https://coindoo.com/fbi-confirms-north-korea-behind-binance-hack-seeks-blocks/" rel="noopener noreferrer nofollow">the FBI’s request to crypto infrastructure operators</a> covers the effort to block those transactions directly.</p>
<h2 id="what-has-to-happen-before-swaps-return">What has to happen before swaps return</h2>
<p>THORChain’s <a href="https://dev.thorchain.org/concepts/network-halts.html" rel="noopener noreferrer nofollow">developer documentation</a> warns against sending funds to a halted chain, since transactions can sit unprocessed until the halt lifts. The November 1 post gave no reopening date. Node operators will re-enable each chain once they judge it safe.</p>
<p>Three things would show the flaw is closed rather than paused: THORChain publishing the change to how it handles external reorgs, node operators upgrading to it, and ETH signing returning alongside trading on the halted chains. After the May exploit, that path ran from an emergency patch to a full fix and reopened trading over more than five weeks. That is a reference for the process, not a timetable for this one.</p>
<p>The returned 10 ETH settled the October 31 payout. Re-enabled ETH signing would be the first public sign that operators trust THORChain to handle the next reorg.</p>
<p>The post <a href="https://coindoo.com/eth-refund-bug-froze-thorchain-trading-chains/" rel="noopener noreferrer nofollow">How a 10 ETH Refund Bug Froze THORChain Trading on 10 Chains</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

How a 10 ETH Refund Bug Froze THORChain Trading on 10 Chains

Table of Contents

Coindoo.com

Other articles published on Nov 2, 2026

Join our free newsletter for daily crypto updates!