How a 10 ETH Refund Bug Froze THORChain Trading on 10 Chains
A one-block Ethereum reorganization led THORChain to refund a 10 ETH deposit twice, and the flaw behind it applies to reorgs on any chain the protocol connects to.
Key Takeaways
- One-block Ethereum reorg at 11:34 UTC, October 31
- Sender returned the extra 10 ETH payout
- ETH signing halted within about two minutes
- Ten chains halted, four trading on November 1
THORChain set out the sequence in a post on X on November 1, saying the user had returned the extra 10 ETH and that core developers were working on the necessary changes.
What the reorg removed
At 11:34 UTC on October 31, Ethereum replaced one recent block with a competing version. The discarded block contained a 10 ETH deposit to a THORChain vault, which the protocol’s observers had already seen and credited.
Blocks that recent are still open to replacement. Ethereum treats a block as finalized only after about two epochs, roughly 13 minutes, and nothing in THORChain’s account suggests finalized history changed. The failure happened inside THORChain, which acted on a deposit before Ethereum had settled it.
Two payments followed. The swap attached to the credited deposit missed its price limit, so THORChain refunded 10 ETH. The sender’s deposit on Ethereum’s accepted chain was then refunded as well. One 10 ETH deposit reached the vault, and 20 ETH left it.
THORChain’s own warning shows how one deposit could be counted twice. Every Ethereum account numbers its transactions with a nonce. Once the original transfer vanished with its block, that nonce could be used again on the accepted chain. THORChain wrote that during any external reorg, “a malicious actor could perform a new transaction with the same nonce” and be paid from its vaults.
Every node saw the reorg. The refund went out anyway.
Detection was not the problem. According to THORChain, every node registered the reorg, but the automated re-check meant to settle the deposit’s status could not finish before THORChain finalized the observation on its own chain. The Bifrost documentation describes how observations are reversed when an external transaction disappears. On October 31, that reversal did not happen before the refund was paid.
The post does not say why the re-check ran out of time or what the fix will change. Repayment covered this payout only because the recipient chose to return it. As THORChain described the flaw, it pays whoever triggers it, and someone timing transactions around a future reorg would have no reason to send anything back.
Why a 10 ETH flaw froze ten chains
THORChain’s automatic solvency checker spotted the shortfall and halted ETH swaps. Within about two minutes, node operators also stopped ETH transaction signing, which blocks payouts from the vaults. They then halted trading on other chains as a precaution, because the nonce warning covers reorgs on any connected chain, not only Ethereum.
Where THORChain’s services stood
Trading halted
ATOM, BCH, BSC, BTC, DOGE, ETH, LTC, SOL, TRON, ZEC
Trading active
AVAX, BASE, RUNE, XRPL
Outbound payments
Status data from October 31 showed signing still enabled on most halted chains, so pending payouts could leave while new swaps stayed blocked.
Trading status per THORChain’s November 1 post; signing status per THORChain’s status API as reported on October 31.
The list has already shifted once. On the evening of October 31, The Defiant reported that THORChain’s status API showed trading paused on 12 of 13 external chains. By the November 1 post, three of them had been re-enabled. THORChain did not say why those three went first.
None of this stops the underlying networks. Bitcoin, Ethereum and the other chains keep producing blocks; the halts only limit what THORChain will process for each one.
Read one way, the incident shows the safeguards working. The checker fired without human input, payouts stopped within minutes, and the exposure stayed at 10 ETH. In May, the same check had to halt trading and signing after an exploit drained about $10.7 million from a vault. What the checker cannot do is repair the observation logic, which is why the halts widened instead of easing once the vault was whole again.
Three votes to stop, four to overrule
Halts like these are operational settings, and THORChain’s governance documentation lets a small group of nodes change them. A setting needs at least three active-node votes and must outpoll every competing value; a tie leaves the current setting in place.
That threshold has been tested in public before. During the February 2025 laundering of funds stolen from Bybit, three validators voted to halt ETH trading, and other node operators reversed the vote almost immediately. THORChain’s November 1 account also notes that halting a chain does not hand nodes control of vault assets. Stopping activity and signing transfers are separate powers.
A halt THORChain would not use against launderers
On September 28, facing calls to freeze funds from the Bitget hack, THORChain wrote on X that a network halt is an emergency security measure meant to protect the protocol, and declined to use one against those funds. The reorg flaw is exactly that kind of emergency, and the halt it triggered caught the launderers anyway.
Chainalysis, which attributes the $6.4 billion Binance theft to North Korea’s TraderTraitor group, said on November 1 that THORChain had “inadvertently delayed the laundering of a significant amount of funds stolen from Binance.” The delay came from the same feature that frustrates ordinary users: a halted chain processes nobody’s swaps. Coindoo’s coverage of the FBI’s request to crypto infrastructure operators covers the effort to block those transactions directly.
What has to happen before swaps return
THORChain’s developer documentation warns against sending funds to a halted chain, since transactions can sit unprocessed until the halt lifts. The November 1 post gave no reopening date. Node operators will re-enable each chain once they judge it safe.
Three things would show the flaw is closed rather than paused: THORChain publishing the change to how it handles external reorgs, node operators upgrading to it, and ETH signing returning alongside trading on the halted chains. After the May exploit, that path ran from an emergency patch to a full fix and reopened trading over more than five weeks. That is a reference for the process, not a timetable for this one.
The returned 10 ETH settled the October 31 payout. Re-enabled ETH signing would be the first public sign that operators trust THORChain to handle the next reorg.
Alex is Editor-in-Chief of Coindoo and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
