THORChain, a cross-chain liquidity protocol that settles asset swaps between independent networks, temporarily suspended trading across 10 blockchain networks after a one-block Ethereum reorganization created an accounting discrepancy and left one of its vaults with a 10 ETH solvency shortfall. The incident occurred after a deposit was initially recognized by the protocol but was later removed from Ethereum's canonical transaction history.

The disruption exposed the risks cross-chain protocols face when deposits are credited before blockchain transactions have sufficient confirmation security. THORChain's automated monitoring systems detected the deficit and initiated restrictions while node operators and core developers investigated the incident. The event was reported by CoinTrust.

Ethereum Reorganization Creates 10 ETH Accounting Discrepancy

The incident began when a user initiated a 10 ETH deposit into one of THORChain's vaults. The transaction initially appeared in an Ethereum block, prompting THORChain to observe the transfer, credit the deposit and update its internal accounting records.

At 11:34 UTC on October 31, Ethereum experienced a one-block reorganization. In a chain reorganization, previously accepted blocks are replaced by an alternative version of the blockchain. The block containing the 10 ETH deposit was dropped and the transaction never appeared on Ethereum's canonical chain.

Although every THORChain node detected the reorganization, a re-check that should have removed the deposit did not receive a clear answer in time. The deposit was therefore finalized within THORChain's system even though the corresponding funds were not present on the canonical Ethereum chain.

The associated swap also failed to meet its specified price limit. THORChain refunded the transaction rather than completing the exchange, but the vault had already paid out the equivalent of 10 ETH without receiving a settled deposit. The sender's actual deposit was refunded as well, leaving the vault with a deficit and creating a temporary solvency issue.

The incident demonstrated how an external blockchain reorganization can create financial exposure for a cross-chain protocol when a deposit is processed before the transaction reaches an adequate level of confirmation security. Cross-chain systems typically wait for a transaction to accumulate multiple block confirmations before crediting inbound funds, a buffer intended to reduce the chance that a credited transfer is later removed from the canonical chain.

Trading Halted Across 10 Networks

THORChain's automated solvency checker identified the discrepancy after the vault's available balance no longer matched its recorded obligations. The checker halted Ethereum swaps automatically. Within approximately two minutes, node operators stopped signing Ethereum transactions, preventing additional ETH from leaving the vaults.

Three node votes then halted all ETH outbound payments. Node operators subsequently halted every chain as a precaution while core developers investigated the issue. Although the original discrepancy involved an Ethereum deposit, the broader suspension reflected the way THORChain's liquidity and settlement infrastructure connects multiple blockchain networks.

The halt also underscored the importance of maintaining consistent accounting across independent blockchains, where confirmation standards and transaction finality can differ. A problem affecting one part of a decentralized exchange's infrastructure can require wider safeguards when networks share protocol components.

In a November 1, 2026 post on X, THORChain described the incident and listed the affected networks. The post stated that the trading blockchains were AVAX, BASE, RUNE and XRPL, while the halted blockchains were ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON and ZEC.

THORChain also said that the 10 ETH had been returned by the user, restoring the affected vault's solvency. The network said the automatic solvency checker had detected the shortfall, that node operators had halted ETH transaction signing, and that all chains were then halted so core developers could investigate.

The protocol said the failed re-check left the deposit finalized after the reorganization. It also warned that, because the issue was now public, a malicious actor could potentially submit a new transaction with the same nonce after a reorganization on an external chain and receive funds from THORChain vaults. A nonce is the sequential identifier that orders transactions from a given account on an account-based chain such as Ethereum, and because a transaction removed in a reorganization never executes on the canonical chain, its nonce remains unused there — leaving room for a different transaction to be submitted later with the same identifier.

User Returns Funds and Restores Solvency

The immediate financial shortfall was resolved when the user returned the missing 10 ETH to THORChain. The repayment restored the affected vault's solvency and addressed the deficit created by the unsuccessful swap.

The return of the funds did not automatically reopen trading across the affected networks. THORChain said that three node votes can trigger emergency halts to protect network solvency. Four counter node votes can reverse such a halt, while five node votes can reverse that reversal, continuing in that sequence. The voting process is intended to balance decentralized control with the need for rapid emergency intervention.

THORChain also stated that halting a chain does not give the participating nodes control of the assets. Core developers were working on the necessary fixes, while nodes would decide when individual chains were safe to re-enable.

Developers Work on Reorganization Safeguards

The incident drew attention to transaction confirmation policies and reorganization protection in cross-chain systems. Protocols that process deposits across multiple blockchains must account for the possibility that a transaction included in an initial block can later be reversed or removed from the canonical chain.

For THORChain, improvements to deposit verification and settlement procedures are important because the protocol facilitates asset transfers and swaps between independent networks. The developers' work is intended to strengthen safeguards against similar accounting discrepancies and improve the protocol's handling of unexpected blockchain reorganizations.

Although the returned funds resolved the immediate solvency problem, the resumption of trading depends on the technical safeguards under development and on decisions by THORChain's node operators. The decentralized operators are responsible for assessing when each affected network can safely resume normal transaction processing.