Cross-chain liquidity protocol THORChain froze trading on ten blockchains after a one-block Ethereum reorg caused its vaults to pay out twice on a single 10 ETH deposit. The protocol lets users swap assets between the blockchains it connects: deposits go into its vaults, and node operators sign the payouts that leave them. It set out the sequence in a post on X on November 1, saying the user had returned the extra 10 ETH and that core developers were working on the necessary changes.

What the Reorg Removed

At 11:34 UTC on October 31, Ethereum replaced one recent block with a competing version. The discarded block contained a 10 ETH deposit to a THORChain vault, which the protocol's observers had already seen and credited.

Blocks that recent remain open to replacement. Ethereum treats a block as finalized only after about two epochs, roughly 13 minutes, and nothing in THORChain's account suggests finalized history changed. The failure happened inside THORChain, which acted on a deposit before Ethereum had settled it.

Two payments followed. The swap attached to the credited deposit missed its price limit, so THORChain refunded 10 ETH. The sender's deposit on Ethereum's accepted chain was then refunded as well. One 10 ETH deposit reached the vault, and 20 ETH left it.

THORChain's own warning shows how one deposit could be counted twice. Every Ethereum account numbers its transactions with a nonce. Once the original transfer vanished with its block, that nonce could be used again on the accepted chain. THORChain wrote that during any external reorg, "a malicious actor could perform a new transaction with the same nonce" and be paid from its vaults.

Every Node Saw the Reorg. The Refund Went Out Anyway.

Detection was not the problem. According to THORChain, every node registered the reorg, but the automated re-check meant to settle the deposit's status could not finish before THORChain finalized the observation on its own chain. The Bifrost documentation describes how observations are reversed when an external transaction disappears. On October 31, that reversal did not happen before the refund was paid.

The post does not say why the re-check ran out of time or what the fix will change. Repayment covered this payout only because the recipient chose to return it. As THORChain described the flaw, it pays whoever triggers it, and someone timing transactions around a future reorg would have no reason to send anything back.

Why a 10 ETH Flaw Froze Ten Chains

THORChain's automatic solvency checker spotted the shortfall and halted ETH swaps. Within about two minutes, node operators also stopped ETH transaction signing, which blocks payouts from the vaults. They then halted trading on other chains as a precaution, because the nonce warning covers reorgs on any connected chain, not only Ethereum.

Where THORChain's services stood as of the November 1 post:

• Trading halted: ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC
• Trading active: AVAX, BASE, RUNE, XRPL
• Outbound payments: Status data from October 31 showed signing still enabled on most halted chains, so pending payouts could leave while new swaps stayed blocked.

Trading status is per THORChain's November 1 post; signing status is per THORChain's status API as reported on October 31.

The list has already shifted once. On the evening of October 31, The Defiant reported that THORChain's status API showed trading paused on 12 of 13 external chains. By the November 1 post, three of them had been re-enabled. THORChain did not say why those three went first.

None of this stops the underlying networks. Bitcoin, Ethereum and the other chains keep producing blocks; the halts only limit what THORChain will process for each one.

Read one way, the incident shows the safeguards working. The checker fired without human input, payouts stopped within minutes, and the exposure stayed at 10 ETH. In May, the same check had to halt trading and signing after an exploit drained about $10.7 million from a vault. What the checker cannot do is repair the observation logic, which is why the halts widened instead of easing once the vault was whole again.

Three Votes to Stop, Four to Overrule

Halts like these are operational settings, and THORChain's governance documentation lets a small group of nodes change them. A setting needs at least three active-node votes and must outpoll every competing value; a tie leaves the current setting in place.

That threshold has been tested in public before. During the February 2025 laundering of funds stolen from Bybit, three validators voted to halt ETH trading, and other node operators reversed the vote almost immediately. THORChain's November 1 account also notes that halting a chain does not hand nodes control of vault assets. Stopping activity and signing transfers are separate powers.

A Halt THORChain Would Not Use Against Launderers

On September 28, facing calls to freeze funds from the Bitget hack, THORChain wrote on X that a network halt is an emergency security measure meant to protect the protocol, and declined to use one against those funds. The reorg flaw is exactly that kind of emergency, and the halt it triggered caught the launderers anyway.

Chainalysis, which attributes the $6.4 billion Binance theft to North Korea's TraderTraitor group, said on November 1 that THORChain had "inadvertently delayed the laundering of a significant amount of funds stolen from Binance." The delay came from the same feature that frustrates ordinary users: a halted chain processes nobody's swaps.

What Has to Happen Before Swaps Return

THORChain's developer documentation warns against sending funds to a halted chain, since transactions can sit unprocessed until the halt lifts. The November 1 post gave no reopening date. Node operators will re-enable each chain once they judge it safe.

Three things would show the flaw is closed rather than paused: THORChain publishing the change to how it handles external reorgs, node operators upgrading to it, and ETH signing returning alongside trading on the halted chains. After the May exploit, that path ran from an emergency patch to a full fix and reopened trading over more than five weeks. That is a reference for the process, not a timetable for this one.

The returned 10 ETH settled the October 31 payout. Re-enabled ETH signing would be the first public sign that operators trust THORChain to handle the next reorg.