THORChain halted trading on ten blockchains on October 31 after a one-block Ethereum reorg caused the cross-chain liquidity protocol to pay out 10 ETH that one of its vaults never received. The protocol's automatic solvency checker detected the shortfall and stopped ETH swaps, and node operators suspended transaction signing within roughly two minutes to prevent any further outflows. The user involved has since returned the 10 ETH, and the vault is solvent again after the shortfall was covered.

THORChain is a decentralized cross-chain liquidity protocol that enables users to swap assets between independent blockchains through vaults secured by its node operators. A blockchain reorg occurs when recently added blocks are replaced by a different version of the chain, which can invalidate transactions that had appeared to be final. For cross-chain protocols that credit deposits observed on external chains, reorgs are a built-in exposure: even a single-block rewrite can split what a protocol's ledger records from what its vaults actually hold.

How the Ethereum Reorg Caused the Overpayment

THORChain described the cause of the halt in a post on X shared on November 1. According to the team, the reorg "caused THORChain to pay out 10 ETH that a vault never received." The reorg took place at 11:34 UTC on October 31 and lasted only one block. The post also outlined the steps the network took in response.

On October 31, THORChain halted trading on several blockchains. An Ethereum block reorg caused THORChain to pay out 10 ETH that a vault never received. The automatic solvency checker caught the shortfall and halted ETH swaps. Within approximately two minutes, node operators…

— THORChain (@THORChain) November 1, 2026

The problem began with a 10 ETH deposit headed for one of the protocol's vaults. The transaction landed in the block that the reorg dropped, so it never made it onto the canonical Ethereum chain. THORChain had already observed the deposit and credited it, however, meaning the protocol treated the funds as received. That timing created a mismatch between the protocol's ledger and the actual contents of the vault.

The swap tied to that deposit missed its price limit, so the protocol issued a refund. Because THORChain regarded the deposit as received, the vault paid out 10 ETH it had never obtained, while the sender's genuine deposit was refunded as well.

Every THORChain node detected the reorg. The re-check intended to remove the credited deposit, however, could not get a clear answer in time, and the system finalized the deposit anyway. As a result, the vault carried a 10 ETH shortfall.

Emergency Halts and Current Chain Status

The response unfolded through the protocol's layered safety mechanisms. The solvency checker caught the shortfall and halted ETH swapping automatically. Within approximately two minutes, node operators halted ETH transaction signing, which meant no further ETH could leave the vaults. Three node votes then halted all ETH outbound payments, and three additional votes halted every chain as a precaution, giving core developers time to investigate.

THORChain also explained how its emergency halt mechanism works. Three node votes can trigger a halt to protect network solvency, four counter votes can reverse it, and five votes can reverse that reversal. According to the team, "halting a chain does not give those nodes control of the assets." These thresholds mean no single node operator can halt or restore trading unilaterally.

The immediate shortfall has since been resolved: the user involved returned the 10 ETH, and the vault is solvent again after the shortfall was covered.

One further concern remains now that the incident is public. During a reorg on an external chain, a malicious actor could submit a transaction with the same nonce, and the vaults would then pay funds to that actor. Core developers have been working on the necessary fixes.

Trading remains active on AVAX, BASE, RUNE (THORChain's native asset), and XRPL. The halted chains are ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, and ZEC. Nodes will re-enable each chain once they deem it safe, and THORChain will keep trading disabled on these networks until the fixes are complete — making the chain-by-chain restoration of trading the practical marker of when the network considers those fixes done.