THORChain node operators halted swaps involving assets on 10 networks after an Ethereum block reorganization revealed a refund flaw that paid out an extra 10 ETH. The pause affected major networks including Bitcoin, Ethereum, Solana and Tron, while trading on Avalanche, Base and XRP remained available.
The disruption began after a one-block reorg on Ethereum removed a 10 ETH deposit that THORChain had already recognized. According to the reported sequence of events, the protocol later processed a refund for funds its vault had never actually received, exposing a mismatch that could potentially be abused.
How the issue unfolded
The incident started at 11:34 UTC on Saturday, when Ethereum underwent a one-block reorganization. In this case, a 10 ETH deposit that THORChain had already credited was removed from Ethereum’s canonical chain.
After that deposit disappeared, the related swap failed to meet its price limit. THORChain then issued a refund even though the vault no longer had the deposit on record as received. The sender’s actual deposit was also refunded, producing an unintended additional payout of 10 ETH.
That extra payout triggered an automatic pause, prompting node operators to stop swaps on affected networks while they assessed the problem.
Why a block reorg created risk
The core issue was a difference between what THORChain had already accounted for and what Ethereum ultimately recognized after the reorganization. In practical terms, THORChain refunded a payment that Ethereum no longer treated as having happened.
That kind of mismatch creates an opening for abuse. The report said a malicious actor could potentially exploit the gap between THORChain’s internal state and the final state of the Ethereum chain after a reorg.
Networks affected by the halt
Following the incident, THORChain operators paused swaps tied to assets on 10 networks. The networks named in the report as affected included Bitcoin, Ethereum, Solana and Tron.
Not all activity on the protocol stopped. Trading continued on Avalanche, Base and XRP while operators worked through the emergency response.
The article said node operators will decide when to re-enable each chain as they are deemed safe. No broader reopening timeline was confirmed.
Impact on Binance hack fund movements
The emergency pause may also have had an immediate side effect beyond THORChain itself. According to Chainalysis, the shutdown slowed the movement of funds stolen in Binance’s $6.3 billion hack.
Chainalysis said the pause was blocking all users from using crosschain swaps, including North Korean money launderers, until the service comes back online. The article did not say how long the interruption is expected to last.
What comes next
For now, the confirmed next step is a chain-by-chain review by THORChain node operators. Swaps on the paused networks are set to return only once operators consider those routes safe again.
The episode underscores a known challenge for crosschain systems: reconciling temporary blockchain history changes with protocol accounting. In this case, the immediate priority remains restoring service without reopening the refund path exposed by the Ethereum reorganization.
Source: cointelegraph.com