THORChain explained on November 2 why it stopped swaps on October 31. Its vault refunded 10 ETH for a deposit Ethereum no longer accepted; the user returned the extra payment.
THORChain said on November 2 that a user had returned an extra 10 ETH paid out by one of its vaults. The team says the shortfall is covered, but swaps involving some networks remain halted. Developers are fixing a bug that caused THORChain to finalize a deposit Ethereum no longer recognized as valid.
THORChain provides decentralized exchange infrastructure for native assets on different networks, such as Bitcoin and ether. According to its technical documentation, each liquidity pool pairs an asset with RUNE. The protocol routes cross-chain swaps through RUNE; users do not need to hold it or turn their bitcoin into a wrapped token. Nodes jointly operate the vaults that hold users’ deposits.
How did the extra 10 ETH payment happen?
The incident began at 11:34 UTC on October 31, when Ethereum underwent a one-block reorganization. The blockchain dropped a block containing a 10 ETH deposit to a THORChain vault. That deposit never entered the chain ultimately accepted by Ethereum, but THORChain had already observed it and credited the vault.
The requested swap did not meet the user’s price limit, so THORChain issued a refund. Its vault paid out 10 ETH it had never received. The team says the sender also received a refund for the real deposit. The excess payment left the vault 10 ETH short.
Every node detected the Ethereum reorganization. But when they checked again to remove the invalid deposit, they could not obtain a clear answer within the allotted time. THORChain then finalized the invalid deposit.
The team warned that, now the flaw is public, a malicious actor could use the same transaction sequence number, or nonce, during another reorganization to receive funds from the vault without making a valid deposit. It did not describe the user who returned the 10 ETH as an attacker. Nodes are keeping the affected operations halted to prevent further losses while developers fix the bug.
Three nodes can trigger an emergency halt
The automated solvency checker detected the vault shortfall and halted ETH swaps. Within approximately two minutes, node operators also stopped signing ETH transactions. Three node votes prevented more ETH from leaving the vaults. Operators then halted THORChain activity on all chains with three node votes as a precaution while developers investigated.
THORChain says three nodes can trigger an emergency halt. Four nodes voting the other way can reopen operations, while five votes for a halt can stop them again. Stopping operations does not give those nodes unilateral authority to spend the vault’s assets.
THORChain distinguishes between stopping swaps and stopping transaction signing in its developer documentation. When swaps stop, nodes can still observe incoming transfers and pay refunds. When signing also stops, payments from the vault wait in a queue. Halting swaps alone therefore does not stop every outbound payment.
The section starting at 0:42 in THORChain’s October 26 video explains the automated solvency checker through an earlier IBC/GAIA incident. The recording predates the October 31 ETH event; its thresholds and response times refer to that older incident.
Which swaps are open and which remain halted?
In its November 2 update, THORChain listed the swaps still open using the codes below. The restrictions apply to the protocol’s swaps and payments involving those networks; Bitcoin and Ethereum themselves were not halted. RUNE is THORChain’s native asset.
| Status | Network or asset codes in the announcement |
|---|---|
| Trading | AVAX, BASE, RUNE, XRPL |
| Halted | ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC |
The TRON halt is separate from the earlier USDT restriction: TRON swaps reopened on October 9 after Tether lifted its freeze on the protocol’s USDT vaults. The latest update concerns the October 31 Ethereum reorganization and excess refund.
Core developers are fixing the bug, while nodes will decide which chains are safe to re-enable. The team has not announced the new software version, when it will be completed or audited, or a reopening time. The user’s return of 10 ETH covered the vault shortfall, but developers have yet to finish the software fix.
THORChain warns users not to send new funds to its vaults through paused chains. Some deposits made during a halt may wait until operations resume. Users need to check whether both swaps and vault payments are enabled for their chosen network, as a price quote alone is insufficient. No completion times have been announced for individual pending transfers.
