THORChain Halts 10 Chains After a One-Block Ethereum Reorg

THORChain has had swaps paused on ten chains since Saturday, after a one-block Ethereum reorg left one of its vaults paying out ether it never received. A reorg is a chain discarding a block it had already accepted and putting a competing one in its place. This one hit at 11:34 UTC on 31 October and erased a 10 ETH deposit the protocol had already credited to a swap. The swap then missed its price limit. Refund logic paid out twice, once for money the vault never held and once for the sender's real deposit.

How one deposit was refunded twice

Three of the four accounts read here say only that the extra payout triggered an automatic pause. Blockonomi goes further. It names an automatic solvency checker as the thing that stopped ether swaps once the shortfall showed, and says node operators quit signing ether transactions within about two minutes. Three node votes then halted outbound ether payments, and three more halted every chain as a precaution. Blockonomi also gives the arithmetic: three votes halt a chain, four counter-votes reverse it. Cointelegraph, GNcrypto and Coin-Turk carry none of that detail, so it stands single-sourced.

Two tallies of what is still trading

One account lists the ten paused chains in full. Blockonomi gives them as ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC. The other three name only four of the ten: bitcoin, ether, Solana and Tron. Those four all sit on Blockonomi's list, so the three shorter reports are incomplete rather than in conflict. What is still trading resolves less cleanly. Cointelegraph, GNcrypto and Coin-Turk give three chains, Avalanche, Base and XRP. Blockonomi gives four, adding RUNE, THORChain's own asset. Nothing read here says whether RUNE counts as a chain for the purpose of this halt, and the two counts do not reconcile.

The pause the protocol did not choose

The halt drew notice for a reason that has nothing to do with the bug. Proceeds of the hot-wallet theft Binance put at $6.3 billion have been moving across chains for a week, and THORChain is one of the routes. On Saturday the FBI asked node operators, DeFi services and other virtual asset service providers to block transactions tied to addresses it links to a group it calls TraderTraitor. The chain halts landed the same weekend. Chainalysis said on Sunday that the effect was accidental.

"THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance," Chainalysis said.

Three accounts carry that sentence identically. It describes a side effect of a solvency check, not a policy. THORChain's position on blocking has been on the record since September, when it refused Bitget's request to deny service to an attacker's addresses and said a halt is not a selective freeze. Founder John-Paul Thorbjornsen is quoted by all three as saying the protocol would be finished as an experiment if its nodes took it offline, but the wording differs in each, as does the provenance: Cointelegraph presents the line as something he said, GNcrypto attributes it to the third-quarter report, and Coin-Turk ends it differently again. We could not establish which rendering is the original, so the line is paraphrased here and not quoted.

No chain back on yet

None of the four reports a chain re-enabled, and Blockonomi had the ten still down late on Sunday. The protocol has said only that "nodes will decide to re-enable chains as they are deemed safe", which puts a date on nothing. Blockonomi adds that the user who got the duplicate refund sent the 10 ETH back and that the vault is solvent again; no other account read here mentions a return, and it is unconfirmed at this desk. The repair matters more than the restart. Until the refund path can tell a credited deposit from one a reorg has erased, the same sequence is open to anyone willing to force it, and the protocol has said as much: after a reorg a malicious actor could resubmit a transaction with the same nonce. Nothing published over the weekend says that code has changed.