THORChain Suspends Operations Across Ten Networks Following Ethereum Reorganization
A block reorganization triggered an erroneous 10 ETH payout, forcing a protocol-wide security halt.
1Ethereum Block Reorganization Incident
On October 31, 2026, a single block reorganization on the Ethereum network triggered a critical failure within the THORChain protocol. This technical event caused a deposit transaction to be excluded from the final chain, yet the protocol incorrectly registered the assets, leading to an erroneous 10 ETH payout from the reserve.
2Automated System Detection Mechanism
THORChain’s automated solvency monitoring system identified the discrepancy between the protocol's internal records and the actual blockchain state. Within two minutes of the error, node operators intervened to block all outgoing transactions. This rapid response was essential to prevent further unauthorized outflows from the protocol's liquidity pools during the investigation.
3Scope of Operational Suspension
Following the incident, the protocol suspended operations across ten distinct blockchains, including Bitcoin, Solana, BNB Chain, and Litecoin. While these major networks were halted, the team confirmed that exchange services remained functional through Avalanche, Base, RUNE, and the XRP Ledger, allowing for limited cross-chain activity while core security patches were developed.
4Asset Recovery and Resolution
The user who received the erroneous 10 ETH voluntarily returned the funds, effectively restoring the solvency of the THORChain vault. Despite this successful recovery, the development team emphasized that the underlying vulnerability remains a significant risk. They are currently working on technical fixes to prevent similar exploits during future chain reorganizations.
5Security Risks of Reorganization
Developers warned that the incident highlights a persistent risk where malicious actors could intentionally leverage block reorganizations to extract funds from protocol reserves. Because the protocol initially processed the deposit before the chain finalized, the system mistakenly triggered a refund, demonstrating a flaw in how THORChain validates incoming cross-chain deposit transactions.
6Node Operator Governance Decisions
The decision to resume operations across the affected ten networks rests with the node operators. They are tasked with evaluating the security environment and confirming that the proposed patches effectively mitigate the reorganization risk. Each network will be individually assessed before full functionality is restored to ensure the protocol's long-term financial integrity.
7Historical Context of Disruptions
This suspension follows a previous security incident in May 2026, where THORChain halted trading after a suspected exploit resulted in losses exceeding $10.7 million. These repeated operational pauses underscore the inherent challenges of maintaining cross-chain liquidity protocols, particularly when dealing with the unpredictable nature of underlying blockchain finality and reorganization events.
8Implications for Cross-Chain Protocols
The incident serves as a reminder of the fragility of cross-chain bridges when interacting with networks prone to chain reorgs. As THORChain works toward a permanent resolution, the broader DeFi ecosystem must consider how to better synchronize cross-chain state validation to prevent automated systems from being tricked by temporary blockchain inconsistencies.