THORChain Pauses Swaps on 10 Chains After 10 ETH Refund Error
THORChain suspended swaps across 10 blockchains after an Ethereum block reorganization caused it to pay out 10 ETH from a vault that never received the funds. Sources differ on how many networks remain paused, and the protocol says outbound signing continues on most affected chains.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened
THORChain suspended cross-chain swaps on 10 blockchains after a refund error tied to an Ethereum block reorganization on October 31. The protocol's automatic solvency checker detected a 10 ETH shortfall in an Ethereum vault and halted Ethereum swaps, and node operators then paused trading on other networks within roughly two minutes.
The incident began at 11:34 UTC on October 31, when Ethereum replaced a recent block and removed a 10 ETH deposit intended for a THORChain vault. THORChain had already recorded the incoming payment, and when the associated swap failed the sender's price limit, the protocol issued a refund. Because the original deposit was no longer on Ethereum's accepted chain, the refund was sent from a vault that had not received the funds, creating a second 10 ETH payout. According to the protocol's November 2 statement, the recipient later returned the extra 10 ETH, restoring the vault balance.
Scope of the Pause
Reports differ on how many networks remain affected. The Defiant reported that swaps remain paused on 12 chains, while Crypto.news cited a November 2 statement describing 10 affected networks: Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, Cosmos, Bitcoin Cash, Dogecoin, Litecoin and Zcash. Both accounts agree that trading remained available on Avalanche, Base, XRP Ledger and THORChain's native network. The Defiant also reported that outbound signing is enabled on most affected chains, so payments can proceed even while new swaps are blocked. The count discrepancy may reflect a difference in timing or in how the affected set was defined, and readers should check THORChain's network dashboard for the current status of each chain.
Link to the Binance Hack
Chainalysis said the interruption prevented users, including suspected North Korean money launderers, from accessing most of THORChain's cross-chain services. The pause arrived as investigators continued tracing funds stolen from Binance in an October 29 security breach, and Chainalysis said the technical failure had inadvertently delayed the movement of assets linked to that attack. The $6.3 billion figure comes from the Crypto.news report; the source material does not independently verify the breach's size.
Next Steps and Risks
THORChain warned that a similar problem could occur after reorganizations on other supported chains. It said an attacker could exploit the flaw by submitting another transaction with the same nonce after an earlier deposit disappeared from the accepted chain. Developers are preparing changes so that the refund process does not treat discarded transactions as completed deposits. The protocol said node operators will decide when each chain is safe to reopen.
Why It Matters
For Traders
Swap routes on affected chains are paused, so positions relying on THORChain cross-chain liquidity may face delayed exits until node operators reopen each network.
For Investors
A solvency-check failure triggered by a chain reorganization exposes a recurring risk in cross-chain protocols that custody assets across multiple networks.
For Builders
Any bridge or swap protocol that credits deposits before finality can pay out against transactions later removed by reorgs, so confirmation depth needs review.
This article is for information only and is not financial advice. Read the full disclaimer.
