Markets · Security
The cross-chain swap network says an Ethereum block that vanished made it pay out 10 ETH it never received, prompting node operators to halt most of its chains. Ten remain halted.
THORChain, a network that lets people swap coins directly between different blockchains, says a brief glitch on Ethereum made it pay out 10 ether it never received, and that the same weakness could be used against it again. In a post on X at 4:51 p.m. EST Sunday, it explained why it halted trading on most of its chains on Oct. 31. Ten of them remain halted [1].
The stakes are practical. Anyone with coins moving through THORChain on Bitcoin, Ethereum, Solana and seven other chains is waiting on node operators to decide when it is safe to reopen. THORChain gave no date.
The trigger was what Ethereum users call a reorg, short for reorganization: the network briefly accepted a block, then replaced it with another, so transactions in the dropped block never officially happened. "At 11:34 UTC Oct 31, Ethereum had a one-block reorg," THORChain said, which was 7:34 a.m. EDT. "A 10 ETH deposit to one of the vaults sat in the dropped block and never landed on the canonical chain" [1].
THORChain had already counted that deposit. "The swap missed its price limit and was refunded, so the vault paid out 10 ETH it never received," the post says. "The sender's real deposit was refunded as well" [1]. In plain terms, the user was paid back twice.
The network's own checks did see the problem. "Every node detected the reorg. But the re-check that should have removed the deposit could not get a clear answer in time, so it was finalized," THORChain said [1].
What stopped the damage was the solvency checker, an automatic test that compares what THORChain's vaults should hold with what they do hold. "The automatic solvency checker caught the shortfall and halted ETH swaps," the post says. "Within approximately two minutes, node operators halted ETH transaction signing, so no further ETH could leave the vaults." The post adds: "Node operators then halted all chains as a precaution so core developers could investigate" [1].
The money is back. "The 10 ETH has been returned by the user to make the vault solvent again," THORChain said [1].
THORChain listed what is open and what is not. Its node data, pulled by Le Coin at 9:06 p.m. EST through a public gateway, shows the same split [2].
| Status | Chains, per THORChain's post | Count |
|---|---|---|
| Trading | AVAX, BASE, RUNE, XRPL | 4 |
| Halted | ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC | 10 |
Source: @THORChain post, 4:51 p.m. EST Nov. 1 [1]. THORChain's node API at 9:06 p.m. EST shows AVAX, BASE and XRP not halted and the other ten halted; RUNE is THORChain's own chain and is not listed there [2]. Counts are Le Coin's.
That is a partial reopening. When Le Coin checked the same API at 3:08 p.m. EDT on Oct. 31, all 13 external chains it lists showed as halted [3]. Avalanche, Base and XRP have come back since. The node settings also show a network-wide pause value set at block 28,476,550, which carries a timestamp of 11:35:57 a.m. EDT on Oct. 31 [3].
Transactions are stacking up while the chains are closed. THORChain's queue listed 189 swaps and seven outbound payments waiting at 9:06 p.m. EST Sunday, against 179 swaps and five outbound payments at 3:08 p.m. EDT Saturday [2][3].
| Queue | Oct. 31, 3:08 p.m. EDT | Nov. 1, 9:06 p.m. EST |
|---|---|---|
| Swaps waiting | 179 | 189 |
| Outbound payments waiting | 5 | 7 |
Source: THORChain node API via Liquify gateway [2][3]. These are counts, not dollar values.
THORChain's own token was down sharply. CoinGecko put RUNE at $0.5068 at 9:06 p.m. EST, down 17.78% over 24 hours, while ether was at $2,287.67, up 0.75% [5]. We draw no link between the halt and either move.
THORChain's warning is the uncomfortable part. "Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults," it said [1]. A nonce is the counter that makes each transaction from a wallet unique. In other words, the 10 ether was an accident, but the gap that allowed it is now public. "Core developers have been working on the necessary fixes," the post says, and "nodes will decide to re-enable chains as they are deemed safe" [1]. It does not say when a fix will be ready.
A second objection is about who holds the switch. THORChain says "three node votes can trigger emergency halts," that four counter-votes can reverse them, and that "halting a chain does not give those nodes control of the assets" [1]. That is a design choice that favors speed over unanimity, and the halt has now lasted more than 34 hours.
The halt also landed in the middle of another story. The FBI's alert about the Binance attack asked "THORNode operators" among others to block listed addresses [4]. THORChain's post does not mention Binance, and we make no link beyond what the FBI says.
In Le Coin's view, the signal is the order in which chains come back. Ethereum is the chain where the flaw appeared, so its reopening is the one that would show the fix is in. Watch, too, whether the queue keeps growing. A long line of delayed swaps is the clearest measure of what the halt is costing users.
THORChain says a one-block Ethereum reorg on Oct. 31 made it pay out 10 ether it never received. The user returned it. Ten chains remain halted while developers work on fixes, and THORChain warns the gap could be used again.
Holding the Corner.
Not financial advice.